Blockchain Disruption and Smart Contracts · [08:32 28/3/2019 RFS-OP-REVF190006.tex] Page: 1754 1754–1797 Blockchain Disruption and Smart Contracts Lin William Cong Booth School

[0832 2832019 RFS-OP-REVF190006tex] Page 1754 1754ndash1797

Blockchain Disruption and Smart Contracts

Lin William CongBooth School of Business University of Chicago

Zhiguo HeBooth School of Business University of Chicago Booth School and NBER

Blockchain technology provides decentralized consensus and potentially enlarges thecontracting space through smart contracts Meanwhile generating decentralized consensusentails distributing information that necessarily alters the informational environment Weanalyze how decentralization relates to consensus quality and how the quintessentialfeatures of blockchain remold the landscape of competition Smart contracts can mitigateinformational asymmetry and improve welfare and consumer surplus through enhancedentry and competition yet distributing information during consensus generation mayencourage greater collusion In general blockchains sustain market equilibria with a widerrange of economic outcomes We further discuss the implications for antitrust policiestargeted at blockchain applications (JEL C73 D82 D86 G29 L13 L86)

Received May 31 2017 editorial decision May 29 2018 by Editor Itay Goldstein

Blockchain a distributed ledger technology typically managed in adecentralized manner was first popularized as the technology behind thecryptocurrency Bitcoin It has since emerged in various other forms oftenwith the ability to store and execute computer programs This has given rise toapplications such as smart contracts featuring payments triggered by a tamper-proof consensus of contingent outcomes and financing through initial coinofferings Many industry practitioners argue that the blockchain technologyhas the potential to disrupt business and financial services in the way the

The authors thank Matthieu Bouvard Alex Edmans Andreas Park Maureen OrsquoHara Edward ldquoNedrdquo Prescott andHongda Zhong and an anonymous referee for insightful discussions of the paper They also thank Jingtao Zhengfor excellent research assistance that helped shape an initial version of the paper Susan Athey Tom Ding ItayGoldstein Brett Green Campbell Harvey Gur Huberman Wei Jiang Andrew Karolyi Jiasun Li Minyu PengChung-Hua Shen Dominic Williams and David Yermack and seminar and conference participants at ChicagoBooth HBS Notre Dame Mendoza CUHK Econ Ant Financial AEA NBER Conference on Competition andthe Industrial Organization of Securities Markets RFS FinTech workshop NYU Stern FinTech ConferenceFederal Reserve Bank in Philadelphia FinTech Conference USC FOM Conference 25th SFM ConferenceCEIBS Behavioral Finance and FinTech Forum SFS Calvacade Asia-Pacific AMAC FinTech and SmartInvesting Workshop TAU Finance Conference and NBER Conference on Financial Market Regulation providedvery helpful feedback and comments This research was partially funded by the National Science Foundation ofChina [71503183] Send correspondence to Lin William Cong Booth School of Business University of Chicago5807 S Woodlawn Ave Chicago IL 60637 telephone (773)834-1436 E-mail willcongchicagoboothedu

copy The Author(s) 2019 Published by Oxford University Press on behalf of The Society for Financial StudiesAll rights reserved For permissions please e-mail journalspermissionsoupcomdoi101093rfshhz007

nloaded from httpsacadem

icoupcomrfsarticle-abstract32517545427778 by U

niversity of Chicago user on 06 August 2019

Internet disrupted off-line commerce Others remain skeptical of its genuineinnovativeness and real-world applicability not to mention its association withmoney laundering or drug dealing1 Figure 1 displays Google searches showingthe rising popularity of the blockchain technology in recent years as well asthe growing number of open-source projects related to blockchain and smartcontracts

In this paper we argue that despite a plethora of definitions descriptionsand applications of blockchain and decentralized ledger the technology andits various incarnations share a core functionality in providing a ldquodecentralizedconsensusrdquo Decentralized consensus is a description of the state of the worldmdashfor example whether the goods have been delivered or whether a paymenthas been mademdashuniversally accepted and acted on by all agents in thesystem Economists have long recognized that consensus enables agents withdivergent perspectives and incentives to interact as if it provided the ldquotruthrdquowhich has profound implications on the functioning of society includingethics contracting and legal enforcement among others What is key forblockchain technology is that such a consensus is generated and maintainedin a decentralized manner which blockchain advocates believe can improvethe resilience of the system and reduce the rent extracted by centralizedthird parties2 For example on the Bitcoin blockchain given the transactionhistory agents can check and verify transaction records digitally to preventldquodouble spendingrdquo the digital currency and freeing everyone from the need ofa centralized trustworthy arbitrator or third party3

Public blockchains and many permissioned blockchains interact withdispersed record-keepers to reach decentralized consensus using the latesttechnologies Two economic forces naturally arise programmable decen-tralized consensus if achieved tends to make contracting on contingencieseasier thanks to its temper-proof and automated nature however achievingsuch consensus requires sufficiently distributing information for verificationConsequently blockchain applications typically feature a fundamental tensionbetween decentralized consensus and information distribution The formerenhances contractibility and is welfare improving whereas the latter couldbe detrimental to the society This fundamental tension we highlight has beensince recognized by governments media and industry research For example

1 The Economist (2015) has argued that ldquothe technology behind bitcoin could change how the economy worksrdquoMarc Andreessen the cocreator of Netscape even exclaimed ldquoThis is the thing This is the distributed trustnetwork that the Internet always needed and never hadrdquo (Fung 2014) On the negative side see Narayanan andClark (2017) Jeffries (2018) and Stinchcombe (2017)

2 This is evident when Satoshi Nakamoto founder of Bitcoin remarked ldquoA lot of people automatically dismisse-currency as a lost cause because of all the companies that failed since the 1990s I hope its obvious it wasonly the centrally controlled nature of those systems that doomed them I think this is the first time were tryinga decentralized non-trust-based systemrdquo (Narayanan et al 2016)

3 Double spending is a potential flaw in a digital cash system in which the same digital currency can be spent morethan once when a consensus record of transaction histories is lacking Such a lack can result when digital filesare duplicated or falsified

The Review of Financial Studies v 32 n 5 2019

Figure 1Trends in blockchain and smart contractsThe left panel displays the relative search interest and plots each search term relative to its peak (normalizedto 100) for the given region and time The right panel shows the number of blockchains and smart contractprojects hosted on Github a major open-source development platform for coding programs around the worldfrom January 2013 to April 2018

the Jasper Project at the Bank of Canada in 2017 revealed that ldquoMore robustdata verification requires wider sharing of information The balance requiredbetween transparency and privacy poses a fundamental question to the viabilityof the system for such uses once its core and defining feature is limitedrdquo4

Our paper offers the first analysis on this core issue of blockchain As wediscuss in more detail in the literature review there are two economicallyrelevant areas of research on blockchain (1) blockchain mechanisms forgenerating and maintaining decentralized consensus and (2) real-worldimplications given the functionality blockchain provides Our paper contributesto both fronts by highlighting a universal trade-off in this technology (asopposed to analyzing the strategic mining games specific to the Bitcoinprotocol) and studying the impact of this technology on industrial organization

We first provide a simple framework to think about the process of reachingdecentralized consensus on a blockchain in a trade finance applicationMost blockchains have overlapping communities of record-keepers and usersSimilar to third-party arbitrators in the real world they receive signals onthe true state of the world and may have incentives to misreport (tamperor manipulate) With the help of fast-developing real-time communicationtechnologies among decentralized record-keepers a carefully designedprotocol on blockchains can reduce individualrsquos incentive to manipulate andmisreport allowing more efficient information aggregation Compared totraditional contracting blockchains have the potential to produce a consensusthat better reflects the ldquotruthrdquo of contingencies that are highly relevant forbusiness operations thereby enhancing contracting on these contingenciesNevertheless generating a more effective consensus (ie a consensus closer totruth) is predicated on decentralized record-keepersrsquo observing and receiving

4 See Gillis and Trusca (2017) and Chapman et al (2017) de Vilaca Burgos et al (2017) emphasize the samepoint

greater amount of information5 The key insight is that the informationdistribution process changes the informational environment and hence theeconomic behaviors of blockchain participants

Armed with this insight we then analyze the impact of blockchain technologyon competition and industrial organization Specifically our model featurestwo incumbent sellers known to be authentic and an entrant who only hassome probability of being authentic Authentic sellers always deliver the goodswhile the fraudulent ones cannot In each period buyers as a group showup with a constant probability (reflecting the aggregate business condition)shop the sellers based on price quotes and then exit the economy Each sellerobserves her own customers but does not observe the other sellersrsquo prices orcustomers We call this economic environment the ldquotraditional worldrdquo in whichit is infeasible to communicate information across agents in the spirit of Greenand Porter (1984)

In this traditional world because of contract incompleteness sellers cannotoffer prices contingent on the success of delivering the goods The lemonsproblem thus precludes entry On the other hand two incumbents mightengage in collusion in equilibrium However because incumbent sellers cannotdifferentiate the event of no buyers showing up from the event of the otherseller stealing her market share aggressive price wars occur too often makingit relatively difficult to sustain collusion among incumbent sellers

In contrast blockchains via decentralized consensus enable agents tocontract on delivery outcomes and automate contingent transfers Hence theauthentic entrant is now able to signal her authenticity fully This eliminatesinformation asymmetry as a barrier for entry and greater competition enhancingwelfare and consumer surplus in this ldquoblockchain worldrdquo Beyond authenticityand delivery we further show that in an extension with privately observed sellerqualities blockchain consensus can also mitigate informational asymmetryover service qualities thereby improving consumer surplus and welfare

However as mentioned before generating decentralized consensus alsoinevitably leads to greater knowledge of aggregate business condition on theblockchain which we show can foster tacit collusion among sellers In contrastto the traditional world where sellers do not observe one anotherrsquos businessactivities in the blockchain world they at least can infer the aggregate businesscondition on the blockchainmdashby serving as record-keepersmdashand hence are ableto detect deviations in any collusive equilibrium Consistent with this intuitionwe show that with blockchains in which only incumbents can participatethere are always weakly more collusion equilibria than those sustainable inthe traditional world

Our model thus features the trade-off between potentially enhancedcompetition and aggravated collusion both arising from the blockchain

5 Some of the information can be encrypted In the case of public blockchains (eg Bitcoins) the consensus istypically generated by all users

technology More generally with blockchain (accessible to both incumbentsand entrants) and smart contracts the set of possible dynamic equilibriaexpands leading to social welfare and consumer surplus that could be higheror lower than in a traditional world

Our findings relate to the widespread concern that blockchains mayjeopardize market competitiveness in a serious way This becomes especiallyrelevant for permissioned blockchains with powerful financial institutionsas exclusive members (Kaminska 2015) Our paper highlights one salienteconomic mechanism through which blockchain facilitates collusion andwe explore policy implications of our model For instance an oft-neglectedregulatory solution is to separate usage and consensus generation onblockchains so that sellers cannot use the consensus-generating informationfor the purpose of sustaining collusion By providing a conceptual descriptionof blockchain and smart contracts from an economic perspective our analysisaims to demonstrate that blockchains are not merely database technologies thatreduce the cost of storing or sharing data Rather the design of the blockchaincan have profound economic implications on consensus generation industrialorganization smart contract design and antitrust policy Overall we provide acautionary tale that blockchain technology while holding great potential inmitigating information asymmetry and encouraging entry can also lead togreater collusive behavior

Our paper adds to the emerging literature on blockchains which thus far hasmainly come from computer scientists Two areas of research on blockchainare economically relevant (1) blockchain mechanisms for generating andmaintaining decentralized consensus and (2) real-world implications giventhe functionality blockchain provides The first category can be further dividedinto those studies analyzing the general process of consensus generation formost blockchains emphasizing the trade-offs in decentralization and thosestudies exploring the game theoretical topics including incentive provisionsand market microstructure taking as given a particular blockchain protocolsuch as the mining protocols in Bitcoin While most of existing literaturesfocus on the latter subcategory our paper adds to the former and links theanalysis directly to the technologyrsquos impact on the real economy

Among studies on the application and economic impact of the technologyHarvey (2016) surveys the mechanics and applications of crypto-finance6

Yermack (2017) evaluates the potential impacts of the technology on corporategovernance Complementary to our discussion on smart contracts Bartolettiand Pompianu (2017) empirically document how smart contracts are interpretedand programmed on various blockchain platforms We add by examiningarguably the most defining features of blockchain and how they interact

6 Other papers on various blockchain application include Malinova and Park (2018) on trading Tinn (2018) ontime-stamping and contracting Cao et al (2018) on auditing Chiu and Koeppl (2019) and Khapko and Zoican(2018) on settlement and Cong et al (2018bc) on crypto-token valuation and platform development

with information asymmetry and affect market competition both of whichare important general issues in economics

Related to our analysis on the underlying mechanism for generatingdecentralized consensus are studies on Bitcoin mining games Kroll et al(2013) note that minersrsquo following the ldquolongest chain rulerdquo should be a Nashequilibrium Biais et al (2019) formalize the mining game and discuss multipleequilibria7 Instead of taking as given specific blockchain protocols suchas that of Bitcoin and analyzing strategic behaviors of miners or marketmicrostructure we take a holistic approach to examine universal featuresof blockchains with a direct focus on how the information distribution thatcomes with decentralization interacts with the quality of consensus generationRelatedly Abadi and Brunnermeier (2018) show that entry competition in manyblockchains promotes fork competition that benefits users Importantly thetechnologyrsquos core concept of decentralization has both pros and cons Concernsfor information distribution constitute a natural force to make a supposedlydecentralized system centralized We focus on the information channel in thispaper while Cong et al (2018a) explore a risk-sharing channel

Our analysis on collusion adds to the large literature on industrialorganization and repeated games with monitoring (Tirole 1988) Our modelingredients partially derive from Porter (1983) and Green and Porter (1984)who study collusion in a Cournot setting with imperfect public monitoring Arecent empirical study by Bourveau et al (2017) shows how collusion relates tofirmsrsquo financial disclosure strategies (information distribution in our language)We instead examine Bertrand competition and link the additional observableor contractible information to the type of monitoring in repeated games underthe technological innovation8

1 Blockchain as a Decentralized Consensus

It is commonly recognized that blockchains provide many functions suchas distributed data storage anonymity data obfuscation shared ledgers andso on Because solutions to these problems are well known outside of theblockchain space the impact of blockchain along these dimensions thoughmaterial is somewhat incidental We therefore focus on their core functionalityof providing decentralized consensus Consequently our model would notapply to a subset of permissioned or private blockchains that generate consensus

7 Eyal and Sirer (2014) and Nayak et al (2016) study ldquoselfish miningrdquo and the related ldquostubborn miningrdquo inwhich miners launch block-withholding attacks Easley et al (2017) and Huberman et al (2017) analyze Bitcointransaction fees and discuss the inefficiencies and congestion in mining and transactions Cong et al (2018a)study how mining pools aggravate the mining arms race and energy consumption and the associated industrialorganization

8 Our analysis of sustainable equilibria is related to Fudenberg and Maskin (1986) our discussion on the applicationof blockchain and smart contract in financial services and transactions is broadly linked to optimal contractingespecially concerning information asymmetry and contract incompleteness (eg Baron and Myerson 1982 Hartand Moore 1988 Tirole 1999)

in the traditional centralized manner In other words rather than analyzingthe technical details of various protocols or additional benefits the technologybrings about this paper underscores the economic implications of decentralizedconsensus and the natural process that accompanies it that is informationdistribution due to decentralization

In this section we first provide an overview of the blockchain technologyhighlighting decentralized consensus as its core feature and the trade-offs therein We then model the generation of decentralized consensusand information distribution before discussing various real-world businessapplications in the financial industry

11 Blockchains and smart contractsThe work on blockchains dates to 1990s (Haber and Stornetta 1990) Howeverit was not until 2008 that blockchains were popularized by Satoshi Nakamotothrough the cryptocurrency Bitcoin (Nakamoto 2008)9 Its simplest form entailsa distributed database that autonomously maintains a continuously growing listof public transaction records in units of ldquoblocksrdquo secured from tampering andrevision Each block contains a time stamp and a link to a previous blockOther forms of blockchains have emerged subsequently with different designson exclusivity transparency and maintenance of the records Yermack (2017)summarizes how blockchains work

All blockchainsmdashto varying degreesmdashaim to create a database system inwhich decentralized agents or institutions can jointly record information andmaintain it with no individual party exercising persistent market power orcontrol One defining feature of blockchain architectures is thus their abilityto maintain in a relatively more effective way a uniform view on the state ofthings and the order of events ndash a consensus

As consensus is essential to many economic and social functions the benefitsand empowerment for everyone sharing and trusting the same ledger are clearSettlements in some cases no longer take days lemons problems and fraudscan be mitigated and the list continues These outcomes will likely affect theagentsrsquo ex ante incentives in the economy Traditionally courts governmentsnotary agencies etc provide such consensus but in a way that was sometimesthought to be labor intensive time consuming and prone to tampering andmonopoly power In this regard many advocates of the technology believethat blockchains hold the promise of disrupting many industries by providingconsensus in a more decentralized manner albeit still potentially costly in waysof energy consumption as well as informational concerns that we focus on inthis paper

9 Boumlhme et al (2015) surveys Bitcoinrsquos design principles and properties risks and regulation Narayanan et al(2016) provides an in-depth introduction to the technical details of Bitcoin blockchain True to the Stiglerrsquos lawof eponymy the ingredients and principles for Bitcoin were introduced much earlier and Nakamotorsquos innovationtruly lies in putting it altogether See Narayanan and Clark (2017) for further details

111 Decentralized consensus To produce and maintain a decentralizedconsensus without a centralized authority blockchain protocols have toincentivize responsible and accurate record-keeping by a community ofdispersed ldquorecord-keepersrdquo typically in a competitive manner while reducingmanipulation and tampering In a sense all decentralized consensus must cometo some form of ldquomajorityrdquo vote though the algorithms may significantly varyacross projects and applications

Two widely discussed designs for maintaining decentralized consensus areproof-of-work (PoW) and proof-of-stake (PoS) PoW rewards record-keeperswho solve complicated cryptographical puzzles in order to validate transactionsand create new blocks (ie mining) It prevents attacks such as a denial-of-service (DoS) attack and ensures that once one observes a valid state ofthe ledger transactions of a certain age cannot be negated because doingso requires the malicious entity to have computing power that can competewith the entire network Consequently the blockchain achieves a tamper-proof consensus of the validity of these transactions Unlike PoW in PoS thecreator of the next block is chosen based on hisher holding of the nativecryptocurrency (ie the stake) Other prominent designs include practicalbyzantine fault tolerance algorithm (PBFT) and the delegated proof-of-stakealgorithm (DPoS)10 Instead of comparing specific designs we will modeldecentralized consensus algorithm in abstraction in order to shed light on mostextant designs

Many algorithm designs in their current forms are imperfect but they haveimproved quickly and substantially For instance several hacking incidents haveoccurred on blockchains and Bitcoin has been criticized for wasting electricitybut multiple proposals to address these issues by improving the protocol designand furthering decentralization have been made11 Practitioners are activelyresearching another problem the lack of consensus when modifying blockchainprotocols which generally leads to forking and temporary confusion aboutwhich blockchain users should follow

112 Smart contracts Szabo envisioned in 1994 (eg Tapscott and Tapscott2016) the concept of smart contracts Although a universally accepted definition(no pun intended) for smart contracts has yet to be reached their corefunctionality is clear transfer at little cost or even automate value transfersbased on a decentralized consensus record of the states of the world This leadsto a natural functional definition smart contracts are digital contracts allowing

10 DPoS works along the same lines as the PoS system except that individuals vote for an overarching entity whorepresents their portion of stake in the system (hence the word delegation) PBFT deals with robust synchronousagreement in the presence of malicious fault nodes

11 Lightning which builds on the Bitcoin blockchain reduces the amount of information that has to be recordedon the blockchain to increase processing power Dfinity incubated by String Lab builds on Ethereum to ensurehigher security and execution speed and startup firms such as BOINC channel mining computation to solvescientific problems

terms contingent on decentralized consensus that are tamper-proof and typicallyself-enforcing through automated execution

Our definition is consistent with and nests the definitions commonly seenamong legal scholars (Lauslahti et al 2016 Szabo 1997 1998) It is importantto note that smart contracts are neither merely digital contracts (many of whichrely on trusted authority for reaching consensus and execution) nor are theyentailing artificial intelligence (on the contrary they are rather robotic)

Without decentralized consensus the party providing centralized consensusoften enjoys huge market power (eg a third party with data monopoly) Andtraditional resolutions by third parties such as courts or arbitrators involve highdegrees of human intervention that are less algorithmic potentially leading togreater uncertainty and cost Smart contracts can increase contractibility andfacilitate exchanging money property shares service or anything of value inan algorithmically automated and conflict-free way12

Concerning contracting theory the decentralized consensus reached byblockchain technology has the potential to greatly reduce the scope ofnoncontractible contingencies the underpinning of the incomplete contractliterature (eg Hart 1995) In particular smart contracts can augmentcontractibility and enforceability on certain contingencies be it the lock-inrequirement for fund withdrawal or the automated payment upon an importerrsquossuccessfully receiving the goods That said the improved contractibilityrequires greater information distribution and the overall impact on the economyis far from obvious

113 Information distribution Achieving decentralized consensus requiresdistributing information to some participants in the system The economictrade-offs involved in information distribution necessary for generating adecentralized consensus are highly relevant from the practical or regulatoryperspective With Bitcoin the consensus is reached and maintained throughdistributing all transaction information (with public-key-encrypted owneraddresses) to the entire population on the blockchain so all transaction details(except for identities) recorded on the consensus are public information Oneobvious issue that arises when pushing for real-world blockchain applicationsis business privacy For instance financial institutions are typically sensitiveto reveal the details of the transaction to unrelated parties For exampletraders may want to hide their identities to prevent front-running (Malinovaand Park 2018) and greater information distribution may also affect industrialorganization and competition as this paper shows

Facing this fundamental trade-off many proposals for better encryptioneffectively mask sensitive information in the process of consensus generation

12 Although a weaker definition of smart contracting requires execution be conducted by centralized parties havinga consensus record still significantly reduces contracting and execution frictions as seen in recent applicationsin the land registry in Georgia (Weiss and Corsi 2017)

Another straightforward compromise is to reach a decentralized consensusfor only a subset of important states of world or to request verification fromfewer nodes (record-keepers) in the blockchain network13 In what ways doesinformation distribution matter beyond privacy concerns Will it affect theeffectiveness of blockchain consensus Extant theory tells us very little

12 A model of decentralized consensus and informationWe build a simple economic model of the mechanism of consensus generationhighlighting the role of record-keepers and the inevitable nature of informationdistribution Our model setup is motivated by the application of trade financewhich has been proposed and widely explored by industry practitioners

121 Trade finance example Consider the following scenario many industrypioneers discuss there are multiple potentially international exporters (sellers)of certain goods which require shipping with proper care (say wine so thetemperature is critical for good condition) The success of selling these goods toimporters (customers) require various other parties such as logistics providersinternational ports and customs (for the flow of goods) notaries and financingintermediaries (for the flow of payments)

Say a seller is shipping the goods to a customer we focus on the informationflow in generating the consensus on delivering the goods a contingencyrepresented by ω in Figure 2 The participants necessarily including the sellerand buyer can monitor the physical conditions (eg location and temperature)of the goods via the end-to-end information collection enabled by sensorssmart input mechanisms and real-time data processing or more broadlyInternet-of-Things (IoT) For better monitoring and more transparency theseIoT sensors could be installed on other relevant parties that handle logisticsThe seller-buyer pair receives this information (including notification of finaldelivery) along the way

Other parties on the blockchain may receive relevant information that canhelp monitor the process For instance the other sellers may also have installedIoT sensors able to detect the goodsrsquo delivery Even without the help of IoTother customers who happen to collect other goods at the same port may observerelevant information on this particular delivery At this stage these signals arenot yet recorded on blockchain

One crucial step on blockchain is to generate a decentralized consensuson ldquowhether the goods has been successfully deliveredrdquo so that informationfrom many relevant parties can be aggregated to something that is accepted bythe communitymdashand recorded to the blockchain This is done by contacting

13 For example Aune et al (2017) discuss the use of first-stage hashing to secure time priority without revealingdetailed information and revealing information later in order to prevent front-running a transaction before itis recorded on a block on distributed ledgers Directly related are the so-called ldquozero knowledge protocolsrdquo incomputer science that allow participants to agree about certain facts without revealing detailed information

Figure 2A diagram of the trade finance example of a blockchainA seller delivers goods to a buyer with ω denoting the contingency of successful delivery Record-keeperspotentially with real-time IoT sensors monitor the delivery and submit their reports yk rsquos The protocol ofblockchain aggregates these reports to form a decentralized consensus z This consensus together with thesmart contract is stored in the block and then added to the blockchain

verifiers on the blockchain In our trade finance example the seller-buyer pairlogistic providers and ports must be contacted Likely other sellers with IoTsare contacted as well because they have the expertise to verify the ldquosuccessrdquoof the delivery in case of disputes In blockchain applications they are whatwe call ldquorecord-keepersrdquo Contacted agents might not truthfully report theirsignalsmdasha possibility that is allowed by our model Finally other customersare contacted as well perhaps serving the purpose of ldquoconsistency check rdquo

Contacted parties then submit their reports yk to the blockchain Then theblockchain protocol generates the decentralized consensus z regarding thecontingency in question based the reports yk A newly created block is addedto the entire chain as shown at the bottom of Figure 2 This newly created blockmust pass certain consistency checks with respect to the history of the existingblockchain (which can be thought of incorporating past reports as an input forgenerating current consensus) before more blocks are added to it14

In this example sellers beyond the seller-buyer pair may receive informationvia two sources on blockchain one via the terminals connected to the

14 This thematic treatment covers the case in which the added block still requires further verification like in thecase of Bitcoin so ldquoaddedrdquo corresponds more to ldquofinalizedrdquo or ldquoconfirmedrdquo

IoT sensors and the other via being contacted to verify the transaction Inour perspective they are playing different roles but the secondmdashas theessential step in generating the consensusmdashis more crucial for the blockchaintechnology Putting the concern of collusion aside the more informationthese industry experts have the better the chance of forming a higher qualityconsensus in this process There is also a lower bound on informationdistribution Even if the transaction to be verified is encrypted the mere fact ofbeing contacted actually reveals information (this point will be highlighted inour model)

122 Model setup To illustrate how decentralization makes the consensusmore effective at the expense of greater information distribution we nowformalize the above trade finance example Our analysis applies to both publicand permissioned blockchains

Suppose a smart contract references a contingent outcome ω which we referto as the ldquodeliveryrdquo of service or goods in the context of our main modelin Section 3 The random variable ω takes the value of one if the delivery issuccessful and zero otherwise and denote the decentralized consensus on ω ona blockchain by z which takes value in 01 as well

As illustrated by the trade finance example participants on the blockchainreceive various signals with the aid of real-time IoT technologies15 Forsimplicity we assume all agents observe ω perfectly Although we couldmodel the information environment as agents receiving signals that might bedifferent from the true contingency ω this complication is unnecessary giventhe misreporting incentives introduced later In fact Appendix A considers thispossibility under a more general formulation and repeats the analysis for a largeclass of linear models to demonstrate the robustness of the trade-off that wehighlight

In practice to reach a decentralized consensus blockchains contact a set ofrecord-keepers who are typically dispersed blockchain participants (hence thename ldquodecentralizedrdquo)16 Cryptocurrency mining to maintain consensus recordis a prominent feature for the likes of Bitcoin and Ethereum Ripple and R3CEV use their own consensus process but also rely on a community of record-keepers The process typically entails both competition and assignment forrecord-keeping as well as post-block validations and is an interesting industryon its own

To model this suppose that the blockchain protocol contacts a set ofK potential record-keepers Record-keepers in the set Kequiv12middotmiddotmiddot K arehomogeneous and for simplicity we model the effectiveness of the consensus

15 Clearly the technology is not applicable for verifying subjective experience

16 Table 1 in Zurrer (2017) contains a detailed list of further examples of record-keepers

for contracting (and potentially other purposes) by minusV ar (ωminus z)17 An effectiveconsensus is the cornerstone for the trust that many Fintech firms purport

Upon contact each record-keeper kisinK submits yk taking values in 01yielding a collection of reports yequivykkisinK As we will elaborate later record-keepers might misreport that is yk = ω For illustration we examine the casein which the consensus is given by

1 with probability

sumkwkyk

0 otherwise

where the weights of the validating noteswk are nonnegative and sum to unityWe also assume that wkrarr0 as Krarrinfin which captures the key concept ofdecentralization The consensus function implies that if record-keepers reportmore successful delivery then the consensus is more likely to be successfuldelivery We focus on how the metric of decentralization K affects the qualityof decentralized consensus and the system-wide information distribution18

123 Record-keepersrsquo information and misreporting Suppose eachrecord-keeper on the blockchain observes the realization of ω the deliverystatus While payment verifications on Bitcoin mostly concerns double-spending issues and require limited information distribution (eg the realidentities of transaction parties are masked) the validations of general economicactivities are typically more complicated potentially requiring more nuancedinformation For example many trade finance blockchains use information fromlocal ships ports banks and border customs to track delivery status potentialaided by sensors and IoT devices with details not fully publicly available (egCorda or some Hyperlydger blockchains)19 In addition record-keepers mayalso receive extra information about the transaction upon contact For exampleIBM currently works on trade finance blockchains that provide record-keepersadditional information about shipment status since to generate consensus ondelivery requires off-chain collaborations and cross-validations with shippingcompanies and import-export controls

Record-keepers may have incentives to misreport For example in tradefinance applications record-keepers are also parties involved in the transaction

17 In reality effectiveness depends on the purpose and use of consensus on each specific blockchain Ourspecification qualitatively captures the universal feature that a consensus is not effective even when it is unbiasedif it is uncertain to always reflect truth accurately Our results are robust to introducing penalty terms for bias andhigh moments of minusV ar (ωminus z)

18 Our results hold for a general z(y)= Z(sum

kwkyk) where Z is a function that takes the values of 01 and satisfies

that E[Z] is differentiable and increasing in the argument and takes the value of 0 or 1 when the argument is0 or 1 This implies that if the reports are all accurate the consensus reflects the true state of the world Theserequirements are broadly consistent with extant blockchain protocols

19 For more complicated business situations the record-keepers likely only observe a noisy signal of the true stateand public information disclosure policy on any blockchain likely affects the record-keeperrsquos signal qualitythereby affecting the quality of decentralized consensus We discuss these issues in Appendix A when weintroduce the general linear model

Bitcoin miners may hide report through ldquoselfish-miningrdquo or double spendcertain coins20 Such incentives also exist in traditional economies businessarbitrators may favor a client and double spending was the issue in traditionalonline payments that originally inspired the creation of Bitcoin In fact mediareports and practitionersrsquo discussions have largely centered on how blockchainhelps reduce tampering manipulation and hacking

In our reduced-form model we assume that each risk-neutral record-keeper ksubmits a report of yk to maximize his normalized utilityU (yky) In particularhe solves

maxykisin01

U (yky)=bk middot |z(y)minusω|minushk|ykminusω| (1)

where bk and hk are positive uniformly bounded above and below from zerofor all k The first coefficient bk is record-keeper krsquos benefit when the wrongconsensus is reached (forming 1minusω when the true state is ω) In the secondterm hk captures the cost of misreporting Depending on the protocol designin specific trade finance applications hk could correspond to reputation cost ina blockchain alliance or it could be the cost of counterfeiting signals in IoTsensors In the case of Bitcoin inaccurate records take longer to be confirmedand have a higher probability to be reversed not to mention the extremely largecomputation power required in PoW systems

124 Information distribution and quality of consensus Each contactedrecord-keeper chooses yk to optimize U in (1) which gives

ylowastk =

ω if bkwklehk1minusω otherwise

The benefit of misreporting is bkwk because it shifts the consensus bywk givenother peoplersquos equilibrium strategies whereas the cost is hk The equilibriumconsensus then is

sumkisinKlowastwk

1minusω otherwise(3)

where Klowast equivkisinK bkwk lthk is the set of truth-telling record-keepers The

resultant quality of the decentralized consensus is

minusV ar(ωminus z)=minusV ar(2ωminus1)

(1minus

sumkisinKlowast

where Klowast equivkisinK bkwk lthk (4)

20 In our model misreporting represents noise but it can also result from record-keepers being hacked

Notice that V ar(2ωminus1) is independent of K Therefore the greater the setK

lowast the higher the quality of the decentralized consensus The benefit ofdecentralization manifests in how the size of contactK improves the quality ofconsensus by diminishing each record-keeperrsquos manipulation incentives andedging the set with truthful report K

lowast closer to the full set K For illustrationconsider the case with homogeneous symmetric record-keepers with bk =bgt0 hk =kgt0 and wk =1K where the consensus quality is proportional tominusIKle b

h which is increasing in K

For more general bk and hk satisfying conditions given below Equation (1)the consensus becomes perfect that is z= ω asKrarrinfin we focus on this case inSection 2 and show how decentralized consensus improves the contractibilityand enhances entry (hence competition) We discuss imperfect consensus inSection 3

125 Relating to the literature on information economics It is important tohighlight the difference between our analysis and the extant literature applyinginformation economics to finance and trading The key difference hinges onthe unique functionality provided by blockchain that is the generation ofdecentralized consensus through information distribution among the set ofrecord-keepers This is the first stage involving ldquodecentralizationrdquo in our tradefinance example illustrated by Figure 2 the system contacts record-keeperslike trading partners ports and other sellerscustomers and they contribute toform the consensus that is accepted by the community Then the consensus canbemdashand often ismdashfurther distributed to all agents on the blockchainmdashthis isthe second stage of information distribution

Earlier literature in financial economics often studies distribution of availableinformation which can be thought of the second stage described above Theleading examples are studies on information disclosure that typically concerntransparency for example the TRACE reporting system on the corporatebond market21 Although transparency affects tradersrsquo incentives and theeffectiveness of market function it is arguably true that trading and aggregationcan still take place even without pre- and post- transparency requirements onTRACE In other words in traditional settings when greater public informationis detrimental regulators or agents can opt to distribute less information

In contrast our paper emphasizes the first stage the distribution ofinformation during consensus generation serves the core function of blockchainin providing decentralized consensus and tamper-proofness The greater thedegree of information distribution the higher the quality of decentralizedconsensus This point shares the same spirit as Chapman et al (2017) whofind that attempts of restricting decentralization in order to reduce information

21 See for example Goldstein et al (2006) and Bessembinder and Maxwell (2008) In particular Bloomfield andOrsquoHara (1999) also find that market makers can use trade information to maintain collusive behavior

distribution often reduce the operational resilience that is supposedly thetechnologyrsquos advantage over centralized systems

In general the quality of consensus and the amount of informationdistribution on blockchains depend on their specific protocols Detailing thevarious consensus mechanisms or deriving the ldquooptimalrdquo blockchain design isbeyond the scope of this paper Nevertheless we provide a brief description ofblockchain applications in the financial industry and the concerns practitionersshare about the informational issue we highlight

13 Blockchain applications in the financial industryWith the core functioning of blockchain in mind we now discuss variousblockchain projects in real-world The applications of blockchain technologyand smart contracts are broad sometimes even beyond the Fintech industryand the applications discussed here are not merely proofs of concept22 Readersfamiliar with the institutional background may skip this subsection and go toSection 14 directly

131 Trade and trade finance Recall our motivating example in Section12 that involves international trade and its associated financing activitiesInternational trade easily accounts for more than USD 10 trillion annuallyaccording to recent World Trade Organization (WTO) report23 Despitetechnological advances in many areas of financial services trade financeremains a largely paper-based manual process involving multiple participantsin various jurisdictions around the world and prone to human error and delaysalong the supply chain24 An importer may fail to strike a deal because thebank offering the letter of credit is not well known in the exporterrsquos country Anexporter may fail to get advanced financing because the bank worries whetherthe goods can be successfully and timely delivered and whether payments fromthe importer can be secured

Blockchain technology can help alleviate the aforementioned frictions intrade As mentioned there are two classes of solutions that the blockchaintechnology can offer One concerns the flow of goods as a decentralized ledgercan better track goods during the process in which goods are shipped storedand delivered (eg physical locations and movements or whether goods arekept with the right temperature) with the help of modern communication

22 Bartoletti and Pompianu (2017) analyze 834 smart contracts from Bitcoin and Ethereum with 1673271transactions They find five main usage scenarios (financial notary games wallet and library) three of whichare related to monetary transfers and transactions and the remaining two are related to recording consensusinformation More than two-thirds of the uses are on managing gathering or distributing money

23 For example World Trade Statistical Review 2017 available at httpswwwwtoorgenglishres_estatis_ewts2017_ewts17_toc_ehtm

24 Small suppliers wait as long as 60 to 90 days to be paid for delivered goods Slow payment hinders their accessto working capital

technology such as the Internet of Things (IoT) and ldquooraclesrdquo which are feedersof information from the offline world The second solution concerns the flowof money associated with trade (eg letter of credit and trade finance this isrelated to the previously discussed trusted payments) Currently both solutionsare being developed in isolation but the industry envisions a fully integratedsystem in the future with a network of shippers freight forwarders oceancarriers ports and customs authorities and banks interacting on a blockchainin real time

In 2016 Barclays and Fintech start-up Wave claim to have become thefirst organizations to complete a global trade transaction using the newWave blockchain platform (Taylor 2016) IBM also has been spearheadingthe application of blockchain and smart contracts to trade finance (Haswell2018) In March 2017 IBM and Maersk cooperating with Hyperledger Fabricannounced the completion of an end-to-end digitalized supply chain pilotusing blockchain technology which involves trading parties and various portsand custom authorities (Allison 2017)25 In early 2017 IBM has venturedfurther by rolling out the Yijian Blockchain Technology Application Systemfor the Chinese pharmaceutical sector It has also collaborated with a groupcompanies to develop a blockchain-based crude oil trade finance platform(Higgins 2017a)26

Some progress has been made in applying blockchain technology to thefreight and logistics industry In September 2017 Maersk partnered with EYMicrosoft Willis Towers Watson and several insurance companies to securelyshare shipping data on KSI a blockchain developed by Guardtime (Hackett2017) In November 2017 it was reported that the association Blockchain inTransport Alliance (BITA httpsbitastudio) whose members include start-up blockchain companies like ShipChain had attracted global giants like SAPand UPS in the traditional sector (BlockchainNews 2017)

132 Trusted payments Payments across long distance or among unknownparties are difficult due to the lack of trust The Society for WorldwideInterbank Financial Telecommunications (SWIFT) mitigates the problem butoften entails ineffective coordination across multiple institutions and hefty feesThis concern becomes further exacerbated with digital payments which areplagued by ldquodouble-spendingrdquo issues

Bitcoin was first offered as a solution and it enables anonymous peer-to-peertransactions recorded on the Bitcoin blockchain that is secure and time stamped

25 This pilot was a consignment of goods from Schneider Electric from Lyon to Newark which involved thePort of Rotterdam the Port of Newark the Customs Administration of the Netherlands the US Departmentof Homeland Security Science and Technology Directorate and US Customs and Border Protection (Allison2017)

26 Other blockchain-based platforms that support lending issuing letters of credit export credit and insuranceinclude HK Blockchain for trade finance TradeSafe and Digital Trade Chain (DTC) Recently blockchainstartup R3 a trade finance tech provider TradeIX and a group of major banks have moved their Marco Polotrade finance platform to the pilot stage (Palmer 2018)

to make it tamper-proof (Nakamoto 2008)27 More importantly by broadcastingall candidate transactions publicly and having ldquominersrdquo constantly competingfor the recording right of new blocks to earn Bitcoins its distributed ledgerprovides a decentralized consensus on whether a transaction has taken place

By design maintaining the decentralized consensus record on Bitcoinblockchain requires the miners to solve NP-complete computational problems(ie mining a form of PoW) whose difficulty level increases with computationpower by design making it unsuitable for large volumes of financialtransactions Subsequent platforms such as Lightning (built on the Bitcoinblockchain) and Stellar (a separate blockchain) have helped improve theprocessing capacity through local channels and multisignature accounts sothat unnecessary information does not have to be part of the decentralizedconsensus28

That said these blockchainsrsquo scripting language is limited Ethereumthe second largest blockchain platform by market capitalization after theBitcoin blockchain allows the use of Turing-complete language and permitsmore complex contingent operations (Turing 1937) providing the archetypalimplementation of smart contracts (Buterin 2014) All valid updates to thecontract states are recorded and automatically executed A group of voluntaryparticipants (Ether miners) maintain a decentralized consensus recording ofthe states and other interacting parties utilize the consensus information toautomate executions of contract terms Additional applications such as Monaxand Phi (String Lab) build on Ethereum to enrich and optimize their smartcontract functionalities and processing power similar to how Web sites buildon the Internet protocol

Traditional players in the financial industry have started the process ofaccommodating the blockchain technology to address the payment problemOriginally known as Ripple Labs Ripple was founded in 2012 to provideglobal financial transactions and real-time cross-border payments and has sincebeen increasingly adopted by major banks and payment networks A (typicallylarge) set of validating nodes achieve decentralized consensus using the Rippletransaction protocol RTXPmdashan iterative consensus process as an alternativeto PoW in which transactions are broadcasted repeatedly across the networkof validating nodes until an agreement is reached Digital transfers are thenautomated by connecting electronically to bank accounts or using the nativecrypto-token Ripples (XRP)

133 Other applications In addition to applications in payments and tradefinance blockchain and smart contracts also can be used in exchanges and

27 Many retailers in Japan already accept Bitcoins (eg The Economist 2017)

28 Counterparty also builds on the Bitcoin blockchain but allows for more flexible smart contracts and maintainsconsensus through ldquoproof-of-burnrdquo that is fees paid in cryptocurrency paid by clients are destroyed and nodesare rewarded for validation from the appreciation of the currency

trading voting and even syndicated loans To that end in 2015 Nasdaq Inclaunched the Linq Platform for managing and exchanging pre-IPO shares andin early 2017 they successfully completed a test using blockchain technologyto run proxy voting on Estonian Tallinn Stock Exchange (Shin 2017) Smartcontracts can enforce a standard transactional rule set for derivatives (a securitywith an asset-dependent price) to streamline over-the-counter (OTC) financialagreements Symbiont offers product with a simple interface for specifying theterms and conditions when issuing smart securities as well as integration withmarket data feeds29

Furthermore Credit Suisse and 12 other banks together with Symbiont leadthe application of the blockchain technology to syndicated loans (Terekhova2017) Finally Walmart recently partnered with IBM and JDcom for ablockchain tracking food production safety and distribution (Higgins 2017b)

14 Verification and informational concerns in practiceOur theory highlights the potential downside of information distributionduring the process of decentralized consensus The concern about informationdistribution and privacy is voiced by practitioners among which R3 CEV anactive blockchain consortium has been outspoken R3rsquos Corda system setsout to tackle the challenge that the only parties who should have access tothe details of a financial transaction are those parties themselves and otherswith a legitimate need to know Even with that the request itself a formof information for proving transaction uniqueness is distributed to someindependent observers changing the information environment of this economyat least partially

While these measures potentially ensure confidentiality two importanteconomic insights are missing from current discussions First contactingfewer record-keepers may reduce the effectiveness of the consensus secondencrypting data means some contingencies cannot be validated and thus cannotbe used in smart contracts Moreover even encrypted data are still data asthe mere act of verification request is still informative to record-keepers aninsight to be highlighted in our model As de Vilaca Burgos et al (2017) pointout in a report for the central bank of Brazil simply encrypting sensitive datais not a viable solution because smart contracts then cannot decide whether atransaction is valid

These observations imply that restricting information distribution oftencomes at the expense of compromising the consensus effectiveness Forinstance R3rsquos Cordarsquos validating model restricts information distribution onlyto the notaries30 As pointed out in the Bank of Canada report mentioned earlier

29 Symbiont is a member of the Hyperledger project a cross-industry open-source collaborative project led by thenonprofit Linux Foundation to advance blockchain technology by coming up with common standards

30 This restriction is to prevent denial-of-service (DoS) attacks that is a node knowingly builds an invalid transactionconsuming some set of existing states and sends it to the notary causing the states to be marked as consumed

Chapman et al (2017) Cordarsquos model requires data replication from the notariesto ensure business continuity rather than each node providing resilience to thesystem like in the case with many public blockchains This makes the so-calledldquosingle point of failurerdquo (SPOF) more likely because the system is once againcentralized In fact in phase 2 of Project Jasper the role of notary in Corda isperformed by the Bank of Canada so an outage at the Bank would prevent theprocessing of any payments

Our model underscores this tension contacting fewer record-keepers reducesthe information distribution but at the expense of compromising the qualityof consensus We now go one step further to analyze the consequence ofdistributing information on industrial organization and competition in Section 2

2 Blockchain Disruption and Industrial Organization

To understand blockchainrsquos impact on the real economy we now castour model of decentralized-consensus generation in a standard dynamicindustrial organization setting similar to Green and Porter (1984) We showthat smart contracts on decentralized consensus help entry which promotescompetition but greater information distribution may foster collusion whichhurts competition

21 Model setupConsider a risk-neutral world in which time is infinite and discrete and isindexed by t t =012 Every agent has a discount factor δisin (01) Inevery period tge0 with probability λ a unit measure of buyers show up eachdemanding a unit of goods They shop sellers and choose the most attractiveoffer We use It to denote this aggregate business condition whether buyers showup in period t Throughout we use ldquobuyersrdquo ldquoconsumersrdquo and ldquocustomersrdquointerchangeably

The goods delivery between the seller and the buyer is modeled like in Section12 It should be clear that although we are building our model in the contextof trade finance goods can be interpreted as a service such as a fund transfer aloan origination or trade financing Buyers (if present) only live for one periodand then exit the economy

Three long-lived sellers who are either authentic or fraudulent are presentA fraudulent seller is unable to deliver the good whereas an authentic selleralways delivers the good to the consumer The consumer obtains an expectedutility qi from seller i In particular with probability qi the consumer obtainsa utility of one and with probability 1minusqi they obtain zero

At the start of the game t =0 two of the sellers A and B are incumbentsknown to be authentic (who have already established a good reputation) A newentrant C privately knows her authenticity but others only have the commonprior belief that C is authentic with probability π later referred to as Crsquosreputation

In every period tge0 each seller receives an iid draw of qi iisinABCThe quality profile q=(qAqBqC) is publicly observable capturing temporaldifferences among sellers We discuss the case when quality is the sellerrsquosprivately information in Section 33 Denote the elements in q in decreasingorder by q(1) q (2) and q (3) respectively this implies that even buyersrsquo choiceof incumbent sellers has welfare consequences We denote the cumulativedistribution function and probability density function of quality distributionby φ(middot) and (middot) and its support by [qq] It costs a seller μ to produce thegoods where μltq to reflect that the transaction with an authentic seller iswelfare-improving

Seller C can potentially enter by paying an arbitrarily small cost of εgt0 hence C enters only if she can ever make strictly positive profit in thismarket after entry31 This allows us to focus on information asymmetry ofseller authenticity as the relevant entry barrier We further assume that beforeobtaining customers the entrant has no loss-absorbing capacity32

22 Traditional worldWe analyze the model in the traditional world starting with the key assumptionon contracting space and information environment there

221 Contracting space and information

Assumption 1 In traditional world no payment can be contingent on whetheror not service delivery occurs Each seller can only observe her own buyers andassociated transaction information

The first part of Assumption 1 reflects certain real-life contract incompletenessthat either limits the effectiveness of consensus or makes contracting onit too costly for a good reference on the costs of writing and enforcingcomplete contracts see Hart (1995) and Tirole (1999) In our context thisimplies that the sellers can only quote a noncontingent price pi(q) privatelyto buyers33 The second part of Assumption 1 implies that in the traditionalworld sellers do not observe othersrsquo price quotes and can be interpreted assellerrsquos quoting customized or ldquobespokerdquo prices based on their proprietary

31 Whether or not the entry decision is made before the quality qC realization is immaterial given the arbitrarysmall entry cost

32 This can be microfounded by some borrowing capacity so that potential entrants cannot implement aggressivepenetration pricing schemes It is a sufficient condition to rule out aggressive penetration pricing (in whichentrants suffer huge losses in order to enter) This is realistic because without accumulation of service profit overtime the entrant typically does not have large initial capital (deep pocket) to undercut price aggressively In factall we need is that Crsquos tolerance for loss L is no more than [qminusπq]+

33 That sellers make offers is realistic in many applications where the customers or buyers are short-lived anddispersed For example banks typically quote the fee for making an international transfer and customers candecide which bank to go to Our main results are robust to this particular trading protocol

data and private interaction with buyers In other words it is infeasible tocommunicate information across agents beyond transactions This assumptionplays a role when we solve for the sellersrsquo collusion equilibrium and is similarto the assumption in Green and Porter (1984) and Porter (1983)

222 Bertrand competition and entry First we consider a competitiveequilibrium in which sellers lower their offered prices until their competitorsquit Suppose that an authenticC enters If πqC ltmaxqAqB any incumbentwill compete to lower the price to μ to entice the customer this period andprevent the enhanced future competition they would have faced had C enteredin this period Without a reputation for being authentic an authentic C onlystands the chance of enticing a customer if πqCgemaxqAqB34 Basicallyentrants can entice customers only when their perceived quality is higher thanthat of the incumbents The next proposition follows

Proposition 21 In a competitive equilibrium the first time an authentic Ccan serve customers is in period τequivmintge0|πqCtIt gemaxqAt qBt orlater Consequently C never enters if πqltq

In the remainder of the paper we focus on the case qgtπq in other wordsthe entrant Crsquos reputation is sufficiently low that no entry ever occurs in thetraditional world The expected future consumer (buyer) surplus and socialwelfare at any time s are respectively

buyer =Es

[ infinsumt=s+1

δtminussIt(minqAt qBt minusμ

)]=δλ

1minusδE[minqAqBminusμ] (5)

total =Es

[ infinsumt=s+1

δtminussIt (maxqAt qBt minusμ)

]=δλ

1minusδE[maxqAqBminusμ] (6)

The presence of fraudulent sellers causes no-entrance of a high quality Ca standard lemons problem We show later that this problem can be better oreven fully resolved by smart contracts with blockchain technology offeringdecentralized consensus

223 Collusive equilibria Besides the competitive equilibrium derivedthere may exist collusive equilibria in this economy Given no-entrance of sellerC we only need to examine potential tacit collusion among the incumbents

34 Even so C may not entice the customer if their incumbents use predatory pricing Note that when πqltq nomatter what q is C cannot enter even with penetration pricing because the maximum loss C can afford is lessthan qminusπq

We restrict each sellerrsquos strategy to the standard supergame strategiesdiscussed in for example Green and Porter (1984) Specifically consider thefollowing strategy indexed by T f for A and B to collude There are twophases

1 Collusion phase Every period after the realization of types Acharges price qA and B charges price qB A and B entice It f (qAqB)and f (qBqA)=It (1minusf (qAqB)) fractions of buyers respectively35

Here f (xy)isin (01) is the proposed anonymous allocation functionpotentially as a function of realized types (eg via setting quotas) Thisallocation function f includes the case in which sellers always equallysplit buyers and the case in which buyers all go to the better seller

2 Punishment phase The punishment phase is triggered once one of thesellers does not have any buyers More specifically the punishmentphase can be triggered either by (1) buyers not showing up this periodor (2) one of the sellers deviating by quoting a cheaper price to entice allthe buyers Once triggeredA andB are engaged in Bertrand competitionfor a fixed T period

Recall that the sellers do not observe other sellersrsquo price quotes and onlyobserves their own customers However this repeated game with privatemonitoring is essentially a game with imperfect public monitoring becausesellers can use the private observation to infer whether there is aggregate activity(customers arriving) It is imperfect in the sense that punishment could betriggered even when no one deviates The equilibrium notion corresponding tothe above strategies is thus akin to public perfect equilibrium

A standard result in the literature of dynamic repeated games is thatsustainable equilibria crucially depend on the discount factor δ with the Folktheorem as the best-known example We therefore proceed to derive the lowerbound of discount factor denoted by δ(T f ) above which an equilibrium witha specified T and f (xy) exists

Lemma 22 Define f (qi)equivEqj [f (qiqj )] to be the expected fraction ofbuyers a seller of type qi entices A collusion strategy with (T f ) as describedabove is an equilibrium if

(M1 minusM2)λδ(1minusδT )geM3(1minusλδminus(1minusλ)δT +1) (7)

where M1 equivE[f (qi)(qiminusμ)] M2 equivE[(qiminusqj )+] M3 equivmaxqiisin[qq][(1minusf (qi)) (qiminusμ)]

Here M1 is a sellerrsquos expected payoff in the ldquostage gamerdquo in each periodduring the collusion phase M2 is that during the punishment phase and M3 is

35 Our analysis is robust to sellers charging a lower colluding price (less than qi )

the maximum gain from deviating When the discount factor δ is sufficientlylow (impatient) the payoff from deviation is relatively large compared with thepunishment going forward so no collusion equilibria can be sustained

Proposition 23 When the discount factor δltδT raditionalo equiv inff δT raditional(T f ) =

inff 1λ

M3M1+M3minusM2

no collusion equilibrium exists for any (T f )

The welfare under (T f ) collusion is determined by f and consumer surplusis determined by both (T f ) and the colluding price The consumer surplusdepends on the length of punishment period T because buyers earn positivesurplus only when the punishment phase is triggered because of an absence ofbuyers in the economy (which occurs with probability 1minusλ in each period)

23 Blockchain worldThe blockchain technology enables the consensus recording of goods-deliverystatus by recordkeepersrsquo verifications As detailed earlier in Section 12 thisverification typically involves distributing information

To highlight the economic force we examine the case of perfect consensusthat is when Krarrinfin so that z= ω and smart contracts on the blockchaincan trigger payment based on this consensus This case captures manyextant blockchains such as Bitcoin Ripple and Symbiont where either theverification request or transaction information is distributed to sufficiently largenumbers of parties including major institutional participants Note this doesnot imply record-keepers are the entire population of the blockchain Moreoveras we discuss in Section 32 the basic trade-off under imperfect consensus isqualitatively the same

Assumption 2 The blockchain contacts infinite participants (including thesellers and a continuum of consumers) to generate an effective decentralizedconsensus More specifically the blockchain consensus z= ω and a seller knowsthe aggregate business condition either by observing the presence of her owncustomers or by inferring the presence of customers upon being contacted

Recall ω is the delivery outcome (whether or not successful) This assumptionimplies that (1) self-executed smart contracts can be perfectly contingent ondelivery outcome consensus and (2) the sellers observe the aggregate businesscondition These are in sharp contrast to Assumption 1 We also note that theblockchain system may have richer information and the results can be extendedto the cases wherein this information is used But our arguments require weakerconditions and it suffices that they observe the aggregate activity

In the rest of this section we demonstrate how blockchain and smart contractscan enhance entry and competition show that the same technology can lead togreater collusive behavior and discuss regulatory implications

231 Smart contracts and enhanced entry With blockchain the entrantnow can offer a price contingent on the success of delivery so that P=(pspf )with ps and pf being prices charged upon success and failure An authenticentrant C can separate from her fraudulent peer by offering (ps0) Thefraudulent type gains nothing from mimicking she knows that she will failto deliver and hence never receive the payment As a result the authenticseller C enters for sure We have the following proposition for the competitiveequilibrium without potential collusion

Proposition 24 In the competitive equilibrium in the blockchain world theauthentic entrant C enters almost surely and first entices customers in periodτ =mintge0|qCtIt gemaxqAt qBt or earlier

In the world with blockchain the expected future consumer surplus and totalwelfare at t =s under a competitive equilibrium are respectively

buyer =Es

[ infinsumt=s+1

δtminussIt(q (2) minusμ)]=

1minusδE[q (2) minusμ] (8)

total =Es

[ infinsumt=s+1

δtminussIt (q (1) minusμ)

]=δλ

Compared with Equations (5) and (6) we see that with smart contracts thatfacilitate entry and hence competition the economy becomes more efficient asboth consumer surplus (linear in the second-order statistic) and welfare (linearin the first-order statistic) improve

232 Enhanced collusion under permissioned blockchain Whileblockchain and smart contracts can improve both consumer surplus and welfareby encouraging entry and competition a dark side of blockchain may resultin dynamic equilibria with lower welfare or consumer surplus than in thetraditional world To highlight the collusion-enhancing effect of blockchainwe first focus on permissioned blockchain for the incumbents which C cannotuse (hence no entry) before discussing blockchains that C can utilize

2321 Collusion using smart contracts With blockchain and smartcontracts sellers can use the enlarged contingencies and hence side paymentto facilitate collusion as illustrated by the following example All sellerscollude to charge the highest amount they can charge upon delivery that isqi effectively extracting full rents from buyers The sellers reach an agreementthat only the best-quality seller in each period takes all consumers and if a sellerwho does not have the best quality takes any consumer a smart contract can

take all its profit automatically and transfer it to other sellers36 By imposingautomatic punishment on deviation the smart contract can potentially supportany collusion regardless of the discount factor

Such explicit form of collusion using smart contracts is easy to detect and canbe forbidden by antitrust law (Section 312) The more relevant and interestingphenomenon is that even without explicit side payment the blockchain still canfacilitate greater collusion which we discuss next

2322 Tacit collusion with a permissioned blockchain In the case of tacitcollusion we consider the same collusion and punishment phases as well asthe allocation rule f like in the traditional world The catch is that instead oftriggering punishment upon deviating or receiving no buyers punishment inthe blockchain world can be further conditioned on whether buyers show upThis is because participants upon being contacted for verification at least knowthat service requests are made this does not even require installment of IoTsensors on participants However being contacted for verification reveals theaggregate state of the presence of buyers which allows the sellers to perfectlymonitor deviation behavior by a colluding fellow37

In other words the repeated game with traditionally imperfect publicmonitoring now achieves perfect public monitoring as deviations can beaccurately detected on blockchain during the consensus generation processCollusive equilibria hence become easier to sustain (without punishment alongthe equilibrium path)

Proposition 25 For given (T f ) denote the threshold discount factor abovewhich collusion is sustained with permissioned blockchain by δBlockchain2

(T f ) andrecall δT raditional(T f ) and δT raditionalo are defined in Proposition 23

1 For any (T f ) we have δBlockchain2(T f ) ltδT raditional(T f )

2 When δisin[inff δBlockchain2

(infinf ) δT raditionalo

) there cannot be collusion

without blockchain but there could be with blockchain

In case 2) the consumer welfare under collusion with blockchain is lower thanthat under competitive equilibrium but without blockchain

36 For smart contracts to work decentralized consensus on delivery contingency of the seller identity is needed sothat the blockchain system has to recognize whether the best-quality seller is serving all consumers In generaldepending on specific collusive equilibria one may penalize deviating contingencies using smart contracts evenwithout information on sellers identitycharacteristic

37 The deviating seller might potentially choose to conduct hisher transaction off-chain to avoid triggering the pricewar and this is relevant given our simplified assumption of incumbents being established authentic ones Howeverin general the augmented contractibility of smart contracts benefits all participants and off-chain stealing can bequite ineffective even for incumbents Besides the flexibility of sellers switching between on-chain and off-chainbusinesses is also questionable given the context of our trade finance applications

24 Blockchain disruptionSuppose now that there is a (potentially public) blockchain that all three firms(incumbents A B and new entrant C) have access to Would the benefit ofentry to consumer outweigh the cost of potential greater collusion

241 Consumer surplus under a public blockchain Recall that Section231 has solved the competitive equilibrium To characterize other collusiveequilibria in this economy consider the following collusion strategy

1 Collusion phase Every period after the realization of types each seller icharges qi contingent on success Let f (qiqj qk)isin (01) be the fractionof the buyers that go to the seller with quality qi when the other twosellers have qualities qj and qk

2 Punishment phase The punishment phase is triggered if one of thesellers does not have any buyers and there are buyers showing up in thisperiod In other words the punishment phase is triggered only if there issome seller deviates Once triggered all sellers are involved in Bertrandcompetition for T periods

Lemma 26 Define f (qi)equivEqminusi [f (qiqminusi)] to be the expected fraction ofbuyers a seller of type qi entices With blockchain the above strategy is anequilibrium if the parameters satisfy

δλ(1minusδT )(M1 minusM2)ge (1minusδ)M3 (10)

where M1 equivE[f (qi)(qiminusμ)] M2 equivE[(qiminusmaxj =i qj )+] and M3 equivmaxqiisin[qq][(1minus f (qi))(qiminusμ)]

The Ms can be interpreted similar to that in Lemma 22 but for three sellersnot two The left-hand side of Equation (10) is also modified because withperfect public monitoring the punishment is more accurately targeted

242 Dynamic equilibria under blockchain disruption More generallyin terms of welfare and consumer surplus the set of equilibrium outcomeswith blockchain disruption is a nontrivial superset of those in equilibria in thetraditional world Denote by Blockchain3 the public blockchain with all threesellers

Theorem 27 The threshold of discount factor δBlockchain3a equiv

supf δBlockchain3(infinf )

is well defined and satisfies δBlockchain3a lt1 For all

δgtδBlockchain3a any consumer surplus and welfare attainable in the traditional

world can be attained with blockchain and some additional equilibria withhigher or lower consumer surplus or welfare also can be sustained

In this theorem the subscript a in δBlockchain3a stands for ldquoallrdquo indicating

that all collusion equilibria can be sustained if the discount factor is aboveδBlockchain3a We can similarly define threshold δBlockchain3

o equiv inf f δBlockchain3(infinf )

Then an even weaker condition for blockchain to potentially hurt consumers isδgtδBlockchain3

o It is also worth remarking that with blockchain the total welfare can be

reduced because it is now possible to sustain an equilibrium in which firmscollude so that in any given period all sales go to the seller with the lowest qi which is lower than that with only incumbents

Our findings are robust qualitatively to having more incumbents and entrantsand the next corollary illustrates how consumer surplus could be lower withblockchain in this more general case

Corollary 28 For mgenge2 if λlt nminus1n

then δT raditionalno gtδBlockchainmo where m and n indicate the number of colluding sellers with and withoutblockchain respectively Consequently for all δisin [δBlockchainmo 1] there is nocollusion in the traditional world with n incumbents while blockchain canlower consumer surplus (with m sellers including new entrants)

3 Discussions and Extensions

This section provides discussions from a regulatory angle and considers severalextensions of our model

31 Measures to reduce collusion on blockchainsOur concern that blockchains can jeopardize market competitiveness is alsoshared by other market observers The concern becomes especially acutefor permissioned blockchains like R3 whose members are powerful financialinstitutions As described by Kaminska 2015 what ldquohellip the technology reallyfacilitates is cartel management for groups that donrsquot trust each other but whichstill need to work together if they are the value and stability of the marketsthey serve rdquo Our paper highlights one particular economic mechanism throughwhich blockchains could hinder competition and provides a rigorous analysison why and how collusion could occur In fact empirical evidence suggests thatgreater information sharing indeed facilitates collusion (Bourveau et al 2017)We now explore regulatory and market solutions to curb collusive behaviors inour framework

311 Blockchain competition versus firm competition Although we focuson the case of a single blockchain on which multiple sellers compete in practicethere are likely to be multiple blockchains which both sellers and buyerscan choose The competition among blockchains naturally goes against thecollusive behaviors of sellers on one blockchain as buyers can always pick theblockchain which offers the best price-adjusted service Although blockchain

competition may mitigate collusive behaviors on specific blockchains inthe long run if a single blockchain becomes dominant due to a networkeffect regulators still have to step in to prevent collusion by breaking upblockchain platforms While this approach of ldquobreaking up big players worksfor traditional industrial firms as well this point is especially relevant forblockchain This is because coordination is integral to the ecosystem ofblockchain and likely interferes with its operation For a new blockchainplatform to be used and competition-enhancing different institutional andretail users have to coordinate on adoption Coordination issues have alreadymanifested themselves in the dominance of early movers such as Bitcoin andEthereum in the cryptocurrency markets38

Of course the above discussion raises other questions Why is it more difficultfor blockchains to collude at least relative to sellers on the same blockchainWhat can governments do to facilitate coordinated adoption of betterdesigned blockchain platforms These are all interesting questions for futureresearch

312 Regulatory nodes and design In the traditional world in general ithelps for regulatory agency to observe and collect more information aboutthe market in order to better detect collusive behaviors Similarly adding aregulatory node in the blockchain especially for private permissioned chainsthat do not automatically include regulators as part of the business ecosystemcan help regulator monitor the economic behaviors of market participants andreduce tacit collusion However in this regard blockchain is no different fromtraditional world The government who has the authority to investigate andpenalize firms can reach the same outcome in both scenarios For instancewithin our model the regulator can detect and hence deter collusion bymonitoring whether buyers (if present) are purchasing goods with the highestquality

In this regard blockchain may offer a significant advantage relative tothe traditional world thanks to real-time and tamper-proof records As aresult regulators do not have to worry about misreporting and time-delaysenabling the detection and containment of collusion and market malfunctionsat relatively high frequency Moreover retrospective auditing is no longer proneto manipulation The hyperledger fabric example in Section 23 illustrates theseeffects

Regulators can also potentially participate in the protocol design Forexample the government can reserve access to certain encrypted informationthat is broadcasted to blockchain participants or record-keepers This directaccess not only enables the elimination of collusions using smart contracts

38 We thank the editor Itay Goldstein for pointing this out to us

(see Section 232) but also allows for the detection of tacit collusion based onstatistical analysis of transaction and pricing behaviors39

313 Separation of usage and consensus generation In the model sellerscan use the information on the blockchain to punish deviations from collusionin a more accurate way They observe the information because the informationis distributed and recorded on the blockchain during the process of consensusgeneration From this perspective one obvious potential solution is to separatethe players who help generate the decentralized consensus from the users ofthat consensus For example in our model if sellers can only use the blockchainfor signing smart contracts with buyers but are excluded from record-keepingactivities they no longer have access to the aggregate-activity information thatfosters collusion

As discussed in the trade finance example in Section 12 excluding sellersfrom record-keeping activities might be challenging This is because naturallythe parties that we should exclude from being contacted for record-keeping arealso likely the ones who are the most qualified to validate a record (eg theexperienced sellers with great expertise within the same industry) Most extantpublic blockchains do not separate the two groups On some blockchains suchas Symbiont record-keepers tend to be a rather separate group from the endusers though this resolution has not been sufficiently explored

The separation of usage and consensus generation is new in the discussionamong blockchain practitioners It reflects yet another economic trade-offbetween decentralization (a resilient system needs a wider range of participants)and centralization (but only a small set of agents with expertise are ableto provide high-quality inputs) and constitutes a direction for future policydiscussions concerning blockchain applications40

32 Imperfect consensusIn Section 2 we have assumed that an infinite number of blockchain participantsare contacted as record-keepers (Krarrinfin) rendering perfect consensusSuppose a finite number of blockchain participants serve as record-keepersso that |K|=Kltinfin Then the resultant imperfect consensus has probability ψto correctly record the delivery status where ψ =

sumkisinKlowastwkle1 and K

lowast = kisinK bkwk lthk as derived in Equation (3)

39 Regulation also touches another important concern when the blockchain storages and processes data on a largescale In trade finance applications it is most likely that at a significant portion of the data are personal dataand hence is subject to regulations such as the General Data Protection Regulation (GDPR) which was enactedon May 25 2018 and is directly applicable to blockchain-based platforms in all EU member states As such apublic and permissionless blockchain would not work It needs to be a private and permissioned blockchain thatis operated by one or more entities who set up the terms of use and these entities serve as controllers who areresponsible and liable for the lawful processing of personal data in compiling with the regulation

40 According to Chapman et al (2017) sufficient decentralization among the record-keepers who are not users maystill preserve the blockchain advantage of resilient and effective consensus

The precisionψ essentially captures in reduced form the quality of consensuswhen consensus generation is imperfect and is consistent with many alternativeprotocols41 In words a successful (failed) delivery might be recorded as asuccessful delivery with probabilityψ (1minusψ) Given the imperfect consensuscan the authentic type still enter the market with the help of blockchain withsmart contract (pspf ) and separate from (instead of pool with) the fraudulenttype

We introduce the entrants capacity to bear its initial loss Lge0 this losscapacity helps authentic entrants separate from fraudulent ones and is arelaxation of the condition to exclude aggressive pricing strategy in footnote 33in Section 2 The authentic seller in the separating equilibrium of stage gamesolves the following

max(ps pf )

ψps +(1minusψ)pf

st ψps +(1minusψ)pf geμ minuspf leL and (1minusψ)ps +ψpf lt0

where the inequalities are the authentic types participation constraint limitedloss capacity and the fraudulent types no-mimicking constraint respectivelyFor instance in the last inequality the fraudulent entrant who never delivers thegood has probability 1minusψ of being recorded as having a successful deliveryand paid by ps and with probability ψ of being recorded as failed receivingpf The above program admits a solution when ψgt μ+L

μ+2L which allows theauthentic type enter for some positive profit without imitation by the fraudulenttype yielding the following proposition

Proposition 31 The use of smart contract on blockchain facilitates entry ofthe authentic type if the consensus quality is sufficiently high that isψgt μ+L

In the limit of μ=0 we find that smart contracting facilitates entry as long asthe consensus is slightly informative of the true state (ψgt 1

2 )In our model there is a continuum of consumers upon arrival which implies

that there is a continuum of transactions to be verified If each verificationprocess draws record-keepers in some independent way then the law of largenumbers across transactions reveals the aggregate state of customer arrivaleven under imperfect consensus Therefore imperfect consensus does notaffect the collusive equilibria supported Overall it weakly reduces entry andcompetition and it is in this sense weakly welfare improving to have perfectconsensus

41 Consider the situation with noisy observation of the true state ω but no misreporting (say the misreporting benefitb is small) Suppose that all symmetric record-keepers correctly observe the delivery outcome with probabilityθ gt 1

2 If the consensus on successful delivery is based on unanimity rule then ψ =θK Similarly the majority

rule says ψ =sumK

k=K2 (Kk

)θk (1minusθ )Kminusk

As we mentioned the key to reducing collusion is to separate sellersfrom record-keepers and directly reduce contacting the former To model thisexclusion of sellers we suppose that for each delivery a seller is contacted withprobability ζ then the probability that a seller is completely unaware of theaggregate service activity conditional on consumers arriving is 1minusζ equiv (1minus ζ )nwhere n is the number of transactions In the collusion-phase a deviation isdetected with probability of ζ instead of with probability one triggering lesspunishment and making the collusion equilibrium more difficult to sustain Thatsaid if the number of transactions is large the equilibrium approaches the onewith perfect public monitoring unless the sellers are strictly prohibited fromacting as record-keepers (ζ =0)

33 Information asymmetry and private qualitiesIn our analysis so far the seller quality is publicly known In this section weallow for privately observed qualities Collusion with private information ingeneral is complex (Athey and Bagwell 2001 Miller 2011) therefore ourfocus is on the competitive equilibrium (and competitive stage games in thepunishment phase of a collusion) We characterize how smart contracts canhelp mitigate allocative inefficiency beyond entry and derive the equilibriumform of smart contracts under market equilibrium

In particular we have shown that smart contracts that are contingent ondelivery success or failure can separate fraudulent sellers from authentic onesMore generally the blockchain can also provide consensus on the qualityof service q We model such functionality by assuming that a noisy signalof quality is contractible using decentralized consensus on the blockchainThis hardly matters when quality is public but can help mitigate informationasymmetry when quality is private

Specifically we assume that when the service quality is q the goods aredefective (yielding zero utility to the buyers) with probability 1minusq and aresatisfactory otherwise (yielding unit utility to the buyers) The blockchainprovides consensus on whether the goods are defective which can be usedin smart contracts Here ldquodefection or ldquosatisfactionrdquo should be somethingthat people can potentially agree about (ie not subjective feelings about theexperience)

Under this extension smart contracts now have three contingenciessuccessfully delivered and satisfactory (s) successfully delivered but defective(sd) and failure to deliver (f ) The corresponding price offers are denoted by(pspsdpf )

331 Allocative inefficiency in the traditional world Without smartcontracts the entrant would always claim it is authentic and has highquality (cheap talk) Similarly incumbents cannot separate themselves eitherFollowing the same logic as before the lemons problem prevents entry and

separation cannot occur even among incumbents with different qualities Wehave

Lemma 32 In the traditional world sellers post the same price pi =μ andeach buyer selects (randomly) one of them Each period the buyers surplus andsocial welfare is E[qi]minusμ

332 World with blockchain and equilibrium smart contracts Smartcontracts enlarge the space of price quotes that sellers can use An authenticentrant would always offer pf =0 to separate from fraudulent entrants whohave no incentive to mimic Meanwhile the choice of pf is immaterial forincumbents because they always deliver and pf is made with zero probabilityWe further impose that psd leps so that payment to the seller is lower uponhaving a defective goodmdasha standard monotonicity assumption in the securitydesign literature42 Then upon enticing customers seller i with quality qi =qearns Sq(P)=qps +(1minusq)psdminusμ and the buyer obtains a utility Bq(P)=q(1minusps)+(1minusq)(minuspsd ) where 1minusps is the utility from the goodservice lessthe payment

Sellers may offer a large variety of smart contracts but only one particularclass of contracts emerges in equilibrium as shown by the following proposition(recall that is the cdf of q)

Proposition 33 There is a competitive equilibrium for each stage game thatis essentially unique in terms of equilibrium payoffs In this equilibrium sellersoffer contracts of the form P

lowast =(ppminus10) A seller of quality qi =q offers(pqpqminus10) with

pq =1minusq+μ+int q

dq (11)

which is decreasing in q Buyers go to the highest-quality seller

Note that a higher-quality seller is willing to offer a greater warranty on theproduct The expected payoff of the seller is still increasing in her quality eventhough a higher-quality seller charges a lower price because her probability ofbuyer satisfaction is higher

Under the equilibrium contract (pqpqminus10) buyers obtain utility 1minuspqregardless of the satisfaction outcome The competitive equilibrium essentiallyis a cash auction in which a bidder with quality qi =q has a private valuation of

42 See for example Innes (1990) Hart and Moore (1995) and DeMarzo and Duffie (1999) Under a marketmechanism by which buyers shop sellers and choose the most favorable one our setup has a naturalreinterpretation under informal first-price auctions with security bids (eg DeMarzo et al 2005 Cong 2017)

hisher service opportunity qminusμ and bids pq 43 In equilibrium buyers choosethe highest quality seller who obtains the second-highest valuation E[q (2) minusμ]in each period with customer arrival (the revenue equivalence theorem) andthe economic outcomes are the same as those in the case in which q is publiclyknown (Equations ((8) and (9)))

Corollary 34 Smart contracts fully resolve informational asymmetry in acompetitive equilibrium and welfare and consumer surplus are independent ofwhether or not seller qualities are private

That said one can show that restricting the form of smart contracts canpotentially increase the consumer surplus in a way similar to how securitydesign affects issuers payoffs For regulators concerned with consumer surpluscollusion and smart contract forms should be jointly considered This jointconsideration is a topic for future studies

4 Conclusion

In this paper we argue that decentralized ledger technologies such asblockchains feature decentralized consensus and tamper-proof algorithmicexecutions and consequently enlarge the contracting space and facilitatethe creation of smart contracts However the process of reaching decen-tralized consensus changes the information environment on the blockchainpotentially engendering welfare-destroying consequences by promotingcollusion

We analyze how this fundamental tension can reshape industry organizationand the landscape of competition it can deliver higher social welfare andconsumer surplus through enhanced entry and competition yet it may also leadto greater collusion In general blockchain and smart contracts can sustainmarket equilibria with a larger range of economic outcomes We discussregulatory and market solutions to further improve consumer surplus suchas separating agents generating consensus from end users

We have modeled the universal feature of blockchains and the key trade-offsof consensus generation and information distribution in reduced form Althoughbeyond the scope of this paper designing a robust consensus protocol andproviding the right incentives for maintaining consensus on specific blockchainswould be an interesting next step and would likely require the joint effort ofcomputer scientists and economists

43 This mirrors the well-known result in the literature of security design that the sellers would offer the leastinformation-sensitive security (ldquoflattest security in the language of security-bid auctions eg DeMarzo et al2005)

Appendix A Consensus Generation Alternative SpecificationsWe still denote the decentralized consensus on ω on a blockchain by z except that they can take ona continuum rather than binary values The set of record-keepers and the effectiveness measure areas previously specified Upon contact each record-keeper kisinK submits yk taking a continuum ofvalues and yielding a collection of reports yequivykkisinK

Depending on the specific blockchain protocol the consensus z(y) is then a transformation ofinputs collected from these contacted record-keepers Again we can write it as

z(y)= Z

) (A1)

which includes many well-known blockchains such as Bitcoin in which the miner who solvesa hard NP complete problem first (which is completely random if miners have homogeneouscomputation power) makes the record block In the language of our model the blockchain protocolrandomly chooses one report from all contacted record-keepers (all miners)

For simplicity we examine a large class of linear model typically used in continuum-signalspace

z(y)=1

yk (A2)

Here the decentralized consensus is a simple average of all selected reports It is easy to show thatour results are robust to heterogeneous and stochastic weights on signals

A1 Information Set of Record-keepers To incorporate potentially noisy observation weassume that each record-keeper on the blockchain has a private signal xi = ω+ ηi where forsimplicity ηi are iid with a mean of 0 and a variance of σ 2

η ηi captures noisy observationsof the true state based on public information and off-chain information available on blockchain aswell as additional information record-keepers have when generating consensus

1k denotes the event of record-keeper k being contacted upon which his or her signal becomesxk = ω+ ηk where ηkrsquos has a mean of 0 and a variance σ 2

K We have σK leση thanks to the additional(potentially encrypted) information In summary the set of all information on the blockchain canbe written as a tuple of

K xii isinK xk1kkisinK z

A2 Misreporting and Manipulation We modify the normalized utility of each risk-neutralrecord-keeper who submits a report of yk to

U (yky)= bk middot (z(y)minus xk)minus 1

2h(ykminus xk)2 (A3)

The first coefficient bkequiv b+ εk is record-keeper krsquos bias in misreporting which is known to therecord-keeper k before submitting hisher report Here the common bias b (among contactedrecord-keepers) has a mean of 0 and a variance σ 2

b capturing the common bias on the blockchainwhich can be interpreted as one institutional transaction party choosing validators within itsproprietary network (peer selection on Ripple or notary choice on Corda) an attempt by holders ofthe crypto-currency to slow down the creation of inflation of the native currency andor a system-wide hacking motive Such common bias is not alien in the traditional economy arbitrators inbusiness arbitration are only rewarded if they are chosen by their clients and may systematicallycater to major clients The idiosyncratic part εk is iid with a mean of 0 and a variance of σ 2

ε The second term captures the private cost of manipulation where h parametrizes how quickly

the cost rises with the magnitude of misreporting which depends on the consensus protocol design

A3 Information Distribution and Quality of Consensus Each contacted record-keeperchooses yr to maximize U in (A3) which gives

ylowastk = ω+ ηk +

Kbk (A4)

The equilibrium consensus then is (recall bk = b+ εk)

yk = ω+1

ηk +h

) (A5)

with the resultant quality of the decentralized consensus

minusV ar(ωminus z)=minus

⎡⎢⎢⎢⎢⎣ σ 2K

K︸︷︷︸signal quality

[σ 2b +

σ 2ε

]︸︷︷︸

manipulation

⎤⎥⎥⎥⎥⎦ (A6)

The first term directly relates to signal quality For instance contacting for verification bysharing some details of the transaction information may reduce σK and hence improves qualityAdditionally the first term in (A6) shows that the average over a greater sample size K smoothsout the observation noises ηkrsquos and hence leads to a better consensus

The more novel second channel is rooted in the process of decentralized consensus generationWhen the blockchain contacts more and more record-keepers that is a greaterK each understandsthat each individual has less influence on the final consensus outcome The resultant reducedmanipulation in report ylowast

k in (A4) translates to a higher consensus effectiveness This effect isreflected in the scaling of 1K2 in the ldquomanipulationrdquo terms in (A6) This is the key economic reasonblockchain is deemed more secure in addition to its technical improvements on cybersecurityOf course aggregation certainly helps reach a better consensus by reducing the idiosyncraticcomponents of misreporting as reflected in the denominator of the second term in ldquomanipulationrdquoin (A6)

However contacting more record-keepers affects the information environment in which theagents reside on the blockchain First depending on detailed blockchain protocols solicitingreports involves transferring certain transaction information to contacted record-keepers changingσK 44 Second even with encrypted content information the act of contacting conveys information(denoted by 1k) In the context of an industrial organization framework analyzed in Section 2this renders the aggregate economic activities public information if all agents are contacted whichmakes collusion easier and jeopardizes competition

In conclusion we have demonstrated the robustness in a large set linear models of the trade-offbetween greater decentralization to improve consensus quality and lesser decentralization to reduceinformation distribution

Appendix B Derivations and ProofsProof of Proposition 21

Proof In a competitive equilibrium each seller lowers his or her price until competitors quitIf πqC ltmaxqAqB at least one of the incumbents always competes to lower the price to μ toentice the customer this period and prevent the enhanced future competition had C entered in thisperiod Without a reputation of being authentic an authentic C can only entice a customer if buyersshow up and πqC gemaxqAqB

Because C does not have a capacity to bear loss at the point of entry C cannot charge a penetrationprice below production cost μ and entice customers when πqCt It ltmaxqAt qBt Even whenπqCt It gemaxqAt qBt C may not be able to enter if the incumbents have deep pockets and canengage in predatory pricing

44 Recall the example of Cordarsquos validating model in Section 14

Proof of Lemma 22

Proof We use qi and q interchangeably in various places in the proof to denote the quality of ageneric seller i Let V +(qi qminusi ) be the present value of payoff to a seller with realized quality qiin the collusion phase In the collusion phase buyers are indifferent between different sellers

Let V minus be the present value of payoff to a seller before the realization of type in the first periodof punishment phase According to the collusion strategy the continuation values satisfy

V +(qi qminusi )=λ(f (qi qminusi )(qiminusμ)+δV +)+(1minusλ)δV minus (A7)

V minus(qi qminusi )=λE[(qiminusmaxj =i qj )+]

1minusδT1minusδ +δT V + (A8)

For the strategy to be an equilibrium we need to verify by the one-shot deviation principal thata seller does not have incentive to unilaterally deviate This is obvious in the punishment phasesince it is a Bertrand equilibrium In the collusion phase to prevent deviation we need

forallqV +(q)geλ((qminusμ)+δV minus)+(1minusλ)δV minus (A9)

Denote V +(qi )=Eqminusi [V+(qi qminusi )]f (qi )=Eqminusi [f (qi qminusi )] Integrating (A7) we have

V +(q)=λ(f (q)(qminusμ)+δV +)+(1minusλ)δV minus (A10)

V + =λ(E[f (q)(qminusμ)]+δV +)+(1minusλ)δV minus (A11)

With (A9)ndash(A11) we have

δ(V + minusV minus)ge (1minusf (q))(qminusμ)forallqisin [qq] (A12)

From (A8) to (A11) we solve for (V + minusV minus) Plugging this into the above equation we obtain therange of discount factors that support the collusion strategy as an equilibrium

δλ(1minusδT )(M1 minusM2)geM31minusλδminus(1minusλ)δT +1 (A13)

where M1 M2 and M3 are as defined in the statement of the lemma

Proof of Proposition 23

Proof Since M1 is the expected stage-game collusion rent to a seller and M2

is her payoff in a competitive stage-game equilibrium we have M1gtM2 More-

over M1 +M3gtE[q]minusμ thus 1λ

M3M1+M3minusM2

gt 1λ

E[q]minusμminusM1E[q]minusμminusM2

gt0 Because the least-upper-

bound property (and its implied greatest-lower-bound property) holds the infimumexists

Proof Since the payment can be contingent on completion of service the authentic type canbe separated out from fraudulent type by the following smart contract The buyer pays the sellerps conditional on the success of service otherwise pays zero (or an infinitesimally small negativeamount) The fraudulent type cannot afford to imitate the good type because she can never completethe service and receive the payment Consequently she does not enter and never entices customersThe authentic entrant can entice buyers (if present) if qC gemaxqAqB Then she can charge

payment ps = μ+(qCminusmaxqAqB )qC

contingent on completion of service and zero upon failure to

break the fraudulent typersquos indifference because there is a tiny cost for entry and the fraudulenttype would never enter since she will never be paid

Given the smart contract allows authentic C to costlessly separate A B and C essentiallycompete based on q Any predatory behaviors would only incur losses for the current periodwithout improving future continuation value as future q is iid Therefore there would not be anypredatory (or penetration) pricing

Finally for collusive equilibria if A and B collude they must be charging a weakly higherprice which enables C to entice the first customer earlier

Proof Again we use qi and q interchangeably in various places in the proof to denote the qualityof a generic seller i It is easy to derive

V +(qi qminusi )=λ(f (qi qminusi )(qiminusμ)+δV +)+(1minusλ)δV + (A14)

V + =λ(E[f (q)(qminusμ)]+δV +)+(1minusλ)δV + (A15)

V minus =λE[(qiminusqminusi )+]1minusδT1minusδ +δT V + (A16)

forallqV +(q)geλ((qminusμ)+δV minus)+(1minusλ)δV + (A17)

Collusion can be supported if

δλ(M1 minusM2)(1minusδT )geM3(1minusδ) (A18)

where M1 equivE[f (qi )(qiminusμ)] M2 equivE[(qiminusqminusi )+] M3 equivmaxqiisin[qq] [(1minusf (qi ))(qiminusμ)]f (qi )equivEqminusi [f (qi qminusi )]

Compared to tacit collusion without blockchain the only difference in the above recursiveequations is that the punishment phase is not trigged if the buyers do not show up that is thecorresponding part of the continuation value is (1minusλ)δV + instead of (1minusλ)δV minus

We show that whenever (7) is satisfied so is (A18) This is equivalent to showing

1minusλδminus(1minusλ)δT +1gt1minusδ (A19)

which is equivalent to

δ(1minusδT )(1minusλ)gt0 (A20)

Now for the second part of the proposition note that collusion being impossible when δltδT raditionalo is already proven in Proposition 23

To show there could be when δge inff δBlockchain2(infinf ) we note again by the least upper bound

property inff δBlockchain2(infinf ) is well defined and positive To show one collusion equilibrium exists

we only need to search within the class of f such that f (q) is continuous function that is f isinC([01]) Because C([01]) is a locally convex Hausdorff space that is complete there exists asequence of allocation functions that gets infinitely close to the infimum This means for anyδgeδBlockchain2

o we can find a (T f ) that can be sustained This holds true for our later discussionson infimum and supremum as well

Proof of Lemma 26

V minus =λE[(qiminusmaxj =i qj )+]

Note V + minusV minus =λ(M1minusM2

)(1minusδT

)1minusδ

Proof of Theorem 27 and Discussion

Proof AgainM3

M3+λ(M1minusM2)isin (01) for all f Therefore by the least upper bound property

exists and is less than 1 When δgtsupf δBlockchain3(infinf )

any (infinf ) can be

sustained including the one allocating buyers to the highest quality seller and the one allocating tothe lowest-quality seller Note that for any realization of seller qualities the best-quality seller withblockchain is better than the best-quality incumbent we could attain higher or lower welfaresimilarly the worst-quality seller with blockchain and entry is worse than the worst-qualityincumbent so welfare could be lower Moreover since competitive stage game is always on theequilibrium path without blockchain the consumer surplus is positive With blockchain sellers canextract full rent so lower consumer surplus is attainable Moreover by introducing some punishingon the equilibrium path or lowering the collusion price under blockchain consumer surplus canbe increased to be higher than that in the traditional world (eg under perfect competition) Thusconsumer surplus also can be higher with blockchain

Note for the corollary the most collusive equilibria maximize welfare but sellers fully extractall welfare surplus This equilibrium can be sustained and the results follow

We note M2 is simply the payoff to a seller in a competitive stage game and is almost surely lessthan M1 which is the expected stage game payoff under collusion Therefore inf

fδBlockchain3

(infinf )=

M3M3+λ(M1minusM2)

M3+λ(M1minusM2)isin (01) for all f Again by the greatest-lower bound property

of real-numbered set the threshold is well defined and smaller than 1When δgtδBlockchain3

o the blockchain can support at least one collusion equilibrium that fullyextracts consumer surplus (with no punishment phase on equilibrium path) This is becauseagain there is a sequence of allocation function f within in the complete function space C[01]that arbitrarily approaches the infimum Without blockchain consumer surplus is never zero ascompetitive stage game is always on the equilibrium path Note that even with collusion therehas to be punishment on the equilibrium path Thus consumer surplus is always positive Theconclusion follows

Proof of Corollary 28

Proof For mgt2 in general the previous propositionrsquos proof still applies and δBlockchainmo lt

1 For nge2 when λlt nminus1n

we have 1λ

M3M1+M3minusM2

gt 1λ

E[q]minusμminus 1n (E[q]minusμ)

E[q]minusμ gt

1 Therefore there cannot be collusion with nge2 in the traditional world The corollaryfollows

Proof of Lemma 32

Proof The information asymmetry here is that the buyer does not know a sellerrsquos type Thereforethe buyer makes his decision based on his perception of the type qi and the price charged pi Tobe specific the buyer maximizes his payoff by choosing the seller who can deliver the highestexpected utility

maxiqiminuspi (A25)

If the payoff by choosing any seller is negative the buyer will step out of the marketSuppose there is a separating equilibrium where the pricing schedule is p(q) and the probability

for a seller with type q to be chosen is f (q) For a seller with type q she can pretend to be type qby posting the price p(q) The sellerrsquos expected payoff by doing so is

f (q)(p(q)minusμ) (A26)

Every seller will choose the same q to maximize (A26) which does not depend on q Thereforethe separating equilibrium does not exist

Since there is no separating equilibrium we consider the pooling equilibrium Without areputation system the buyerrsquos perception of each sellerrsquos type is the mean E[q]

This is similar to Bertrand competition Suppose the lower price of the two firms is higher thanμ sayp1gtμ Consider a deviation for the second firm to the pricep2 =p1 minusεgtμ which increasesthe profit of the second firm Therefore in equilibrium we must have p1 =p2 =μ Since we alwaysassume the buyerrsquos decision rule is nondiscriminating the tie is broken randomly Therefore theex ante consumer surplus and social welfare is E[qiuminusμ] where the expectation is taken over therealization of qi This yields E[q]minusμ As a remark outside our parameter assumption if the costis so high that μgtE[q] ex ante utility for the buyer is negative and the buyer will stay out of themarket that is the market breaks down

Proof We first show that using Plowast is an equilibrium We then prove that no other equilibrium

exists The proof resembles the argument in DeMarzo et al (2005) on how the flattest securitiesare always used in an equilibrium of informal auctions with security bids However because thesellers can always offer smart contracts that make the buyersrsquo payoff insensitive to the sellerrsquos typewe do not need to worry about equilibrium refinement Readers who are familiar with DeMarzoet al (2005) should skip the detailed proof below

With Plowast buyers obtain utility 1minusp regardless of the service outcome Conversely any smart

contract that makes buyersrsquo payoff insensitive to seller type has to be of the form Plowast Given that the

buyer taking an offer (ppminus10) obtains 1minusp utility the setup is equivalent to a first-price auctionwhere the buyers are the auctioneers who allocate the business opportunity and sellers are bidderswho bid cash 1minusp The buyers go to the seller with the lowest p From the auction literature aunique symmetric equilibrium with cash bids exists Therefore there is a unique equilibrium whenrestricting smart contracts to P

lowast implying that there is no profitable deviation using contracts thatgive buyers payoff insensitive to seller type The equilibrium offer of type q follows the solutionof symmetric equilibrium of first price auctions (Krishna 2009) and is given by the pq that solves

1minuspq =E

[q(1)Nminus1 minusμ|q(1)Nminus1ltq

]=qminusμminus

[(q prime)(q)

]Nminus1

dq prime (A27)

where q(1)Nminus1 is the highest realized quality among otherNminus1 sellers We note the expression isincreasing in q thus buyers all choose the highest-quality seller Substituting N =3 (one authenticentrant and two incumbents) gives the expression in the proposition

Now suppose this equilibrium breaks down when we allow for smart contracts beyond Plowast

then there must be a profitable deviation by a type q to a quality-sensitive smart contract Pq suchthat Pr(B(Pq ))Sq (Pq )gtPr(Bq (Plowast

q ))Sq (Plowastq ) where Pr(B) is the probability of enticing customers

when buyers believe that they can obtain utility B and B(Pq ) is the buyersrsquo perceived value ofthe deviation contract Denote the set of types that find it profitable to deviate to Pq by Q ThenB(Pq )isinB(Pq (Q)) Therefore existq prime isinQ (possibly q) such that q prime minusSqprime (Pq )=B(Pq (q prime))gtB(Pq )Consider the deviation by type q prime to (pprimepprime minus10) where pprime =1minusq prime +Sqprime (Pq ) Then the probabilityof winning is higher than q prime deviating to use Pq and the payoff conditional on enticing customersare both Sprime

q (Pq ) implying that if it is profitable for q prime to deviate to Pq (which is true since q prime isinQ)It is also profitable for q prime to deviate to the contract (pprimepprime minus10) However this contradicts thefact that there is no profitable deviation using contracts that make buyersrsquo payoff insensitive toseller type Therefore we conclude that the equilibrium described in the previous paragraph is anequilibrium even when we allow general smart contract forms

Next we show that the above equilibrium is essentially unique for the game that is all othersymmetric equilibria have the same payoffs

We first argue that if a smart contract P is offered in an equilibrium and is quality sensitive then atmost one type uses it Suppose otherwise and more than one type use it Let the lowest and highesttypes offering the smart contract be qL and qH then B(P)=Bqlowast (Pqlowast ) for some qlowast isin (qLqH )However P is increasing in quality because ps gtpsd Consequently qL would find it profitable todeviate to offering (ppminus10) where p=1minusB(P) contradicting that in equilibrium both qL offersP Therefore at most one type uses P

Let the type be q then B(Pq )=Bq (Pq ) This implies the allocation and payoffs are unalteredif type q replaces the offer by (pqpqminus10) where pq =1minusB(Pq ) This is because Sq (Pq )=qminusBq (Pq )=qminus(1minuspq )

Because each type q is solving the same optimization problem used in the case in which werestrict to P

lowast we have shown that any unrestricted equilibrium is payoff equivalent to the uniqueand monotone equilibrium with restriction of smart contracts to P

lowastNext the smart contract (psq p

sdq 0) used by type q in such an essentially unique equilibrium

gives type q the same value as (pqpqminus10) That is qpsq +(1minusq)psdq =qpq +(1minusq)pq Becausein the equilibrium with P

lowast a sellerrsquos expected payoff is differentiable q for all q by a standardenvelope argument taking derivatives in the unrestricted equilibrium yields psqminuspsdq =0 Fromthis we conclude that all possible equilibria are payoff equivalent to the unique equilibrium whenrestricting smart contracts to P

lowast and the smart contracts used are also in Plowast This means that no

equilibrium exists other than the one described in the second paragraph of the proofFinally we remark that for incumbents they can use pf =0 without affecting the payoffs and

equilibrium outcomes That is why we say the equilibrium is only essentially unique

References

Abadi J and M Brunnermeier 2018 Blockchain economics Working Paper

Allison I 2017 Maersk and IBM want 10 million shipping containers on the global supply blockchain byyear-end International Business Times March 8 httpswwwibtimescoukmaersk-ibm-aim-get-10-million-shipping-containers-onto-global-supply-blockchain-by-year-end-1609778

Athey S and K Bagwell 2001 Optimal collusion with private information RAND Journal of Economics32428ndash65

Aune R T M OrsquoHara and O Slama 2017 Footprints on the Blockchain Trading and Information Leakagein Distributed Ledgers Journal of Trading 125ndash13

Baron D P and R B Myerson 1982 Regulating a monopolist with unknown costs Econometrica 50911ndash30

Bartoletti M and L Pompianu 2017 An empirical analysis of smart contracts Platforms applications anddesign patterns In Financial cryptography and data security eds M Brenner K Rohloff J Bonneau AMiller P Y Ryan V Teague A Bracciali M Sala F Pintore and M Jakobsson 494ndash509 Cham UK SpringerInternational Publishing

Bessembinder H and W Maxwell 2008 Markets transparency and the corporate bond market Journal ofEconomic Perspectives 22217ndash34

Biais B C Bisiegravere M Bouvard and C Casamatta 2019 The blockchain folk theorem Review of FinancialStudies 321662ndash715

BlockchainNews 2017 UPS-backed blockchain consortium seeks to disrupt the freight and logistics industryCCN November 17 httpswwwccncombita-looking-disrupt-freight-logistics-industry

Bloomfield R and M OrsquoHara 1999 Market transparency who wins and who loses Review of FinancialStudies 125ndash35

Boumlhme R N Christin B Edelman and T Moore 2015 Bitcoin Economics technology and governanceJournal of Economic Perspectives 29213ndash38

Bourveau T G She and A Zaldokas 2017 Naughty firms noisy disclosure Working Paper

Buterin V 2014 Ethereum A next-generation smart contract and decentralized application platform WhitePaper

Cao S L W Cong and B Yang 2018 Auditing and blockchains Pricing misstatements and regulationWorking Paper

Chapman J R Garratt S Hendry A McCormack and W McMahon 2017 Project Jasper Are distributedwholesale payment systems feasible yet Working Paper

Chiu J and T Koeppl 2019 Blockchain-based settlement for asset trading Review of Financial Studies321716ndash53

Cong L W 2017 Auctions of real options Working Paper

Cong L W Z He and J Li 2018a Decentralized mining in centralized pools Working Paper

Cong L W Y Li and N Wang 2018b Tokenomics Dynamic adoption and valuation Working Paper

Cong L W Y Li and N Wang 2018c Token-based corporate finance Working Paper

de Vilaca Burgos A J D de Oliveira Filho M V C Suares and R S de Almeida 2017 Distributed ledgertechnical research in Central Bank of Brazil Working Paper

DeMarzo P and D Duffie 1999 A liquidity-based model of security design Econometrica 6765ndash99

DeMarzo P I Kremer and A Skrzypacz 2005 Bidding with Securities Auctions and Security DesignAmerican Economic Review 95936ndash59

Easley D M OrsquoHara and S Basu 2017 From mining to markets The evolution of bitcoin transaction feesWorking Paper

The Economist 2015 The trust machine October 31 httpswwweconomistcomleaders20151031the-trust-machine

mdashmdashmdash 2017 A yen for plastic November 4

Eyal I and E G Sirer 2014 Majority is not enough Bitcoin mining is vulnerable In International Conferenceon Financial Cryptography and Data Security 436ndash54 New York Springer

Fudenberg D and E Maskin 1986 The folk theorem in repeated games with discounting or with incompleteinformation Econometrica 54533ndash54

Fung B 2014 Marc Andreessen In 20 years well talk about Bitcoin like we talk about the Internettoday Washington Post May 21 httpswwwwashingtonpostcomnewsthe-switchwp20140521marc-andreessen-in-20-years-well-talk-about-bitcoin-like-we-talk-about-the-internet-todaynoredirectonamputm_term24553687a085

Gillis M and A Trusca 2017 lsquoNot there yetrsquo Bank of Canada experiments with blockchainwholesale payment system CyberLex June 19 httpswwwmccarthycaeninsightsblogssnipitsnot-there-yet-bank-canada-experiments-blockchain-wholesale-payment-system

Goldstein M A E S Hotchkiss and E R Sirri 2006 Transparency and liquidity A controlled experiment oncorporate bonds Review of Financial Studies 20235ndash73

Green E J and R H Porter 1984 Noncooperative collusion under imperfect price information Econometrica5687ndash100

Haber S and W S Stornetta 1990 How to time-stamp a digital document In Conference on the Theory andApplication of Cryptography 437ndash55 New York Springer

Hackett R 2017 Maersk and Microsoft tested a blockchain for shipping insurance Fortune Finance Sept 5httpfortunecom20170905maersk-blockchain-insurance

Hart O 1995 Firms contracts and financial structure London Clarendon Press

Hart O and J Moore 1988 Incomplete contracts and renegotiation Econometrica 56755ndash85

mdashmdashmdash 1995 Debt and seniority An analysis of the role of hard claims in constraining management AmericanEconomic Review 85567ndash85

Harvey C R 2016 Cryptofinance Working Paper

Haswell H 2018 Maersk and IBM introduce TradeLens blockchain shipping solution IBM News RoomAugust 9 httpsnewsroomibmcom2018-08-09-Maersk-and-IBM-Introduce-TradeLens-Blockchain-Shipping-Solution

Higgins S 2017a IBM unveils blockchain platform for oil trade finance Coindesk March 28httpwwwcoindeskcomibm-blockchain-platform-oil-trade-finance

mdashmdashndash 2017b Walmart JDcom back blockchain food tracking effort in China CoinDesk December 14httpswwwcoindeskcomwalmart-jd-com-back-blockchain-food-tracking-effort-china

Huberman G J D Leshno and C C Moallemi 2017 Monopoly without a monopolist An economic analysisof the bitcoin payment system Working Paper

Innes R D 1990 Limited liability and incentive contracting with ex-ante action choices Journal of EconomicTheory 5245ndash67

Jeffries A 2018 Blockchain is meaningless Verge March 7 httpswwwthevergecom20183717091766blockchain-bitcoin-ethereum-cryptocurrency-meaning

Kaminska I 2015 Exposing the lsquoif we call it a blockchain perhaps it wonrsquot be deemeda cartelrsquo tactic Financial Times May 11 httpshackernooncomten-years-in-nobody-has-come-up-with-a-use-case-for-blockchain-ee98c180100

Khapko M and M Zoican 2018 How fast should trades settle Working Paper

Krishna V 2009 Auction theory Hoboken NJ Academic Press

Kroll J A I C Davey and E W Felten 2013 The economics of Bitcoin mining or Bitcoin in the presence ofadversaries In Proceedings of WEIS vol 2013

Lauslahti K J Mattila T Seppaumllauml et al 2016 Smart ContractsndashHow will blockchain technology affectcontractual practices Technical Report The Research Institute of the Finnish Economy

Malinova K and A Park 2018 Market Design for Trading with Blockchain Technology Working Paper

Miller D A 2011 Robust collusion with private information Review of Economic Studies 79778ndash811

Nakamoto S 2008 Bitcoin A peer-to-peer electronic cash system Working Paper

Narayanan A J Bonneau E Felten A Miller and S Goldfeder 2016 Bitcoin and cryptocurrency technologiesPrinceton NJ Princeton University Press

Narayanan A and J Clark 2017 Bitcoinrsquos academic pedigree Communications of the ACM 6036ndash45

Nayak K S Kumar A Miller and E Shi 2016 Stubborn mining Generalizing selfish mining and combiningwith an eclipse attack In Security and Privacy (EuroSampP) 2016 IEEE European Symposium 305ndash20 PiscatawayNJ IEEE

Palmer D 2018 R3 pilots blockchain trade finance platform with global banks Coindesk February 21httpswwwcoindeskcomr3-pilots-blockchain-trade-finance-platform-with-global-banks

Porter R H 1983 Optimal cartel trigger price strategies Journal of Economic Theory 29313ndash38

Shin L 2017 Why Nasdaq is even more optimistic about blockchain than it was 3 years ago Forbes Feb 21httpswwwforbescomsiteslaurashin20170221why-nasdaq-is-even-more-optimistic-about-blockchain-than-it-was-3-years-ago234a83271a26

Stinchcombe K 2017 Ten years in nobody has come up with a use for blockchain Hackernoon December 22httpshackernooncomten-years-in-nobody-has-come-up-with-a-use-case-for-blockchain-ee98c180100

Szabo N 1997 Formalizing and securing relationships on public networks First Monday 2

mdashmdashndash 1998 Secure property titles with owner authority Online at httpszabobestvwhnetsecuretitlehtml

Tapscott D and A Tapscott 2016 Blockchain revolution How the technology behind Bitcoin is changingmoney business and the world New York Penguin

Taylor C 2016 Ornua involved in groundbreaking blockchain transaction Irish Times September 7httpswwwirishtimescombusinesstechnologyornua-involved-in-groundbreaking-blockchain-transaction-12782748

Terekhova M 2017 Credit Suisse-led blockchain solution makes progress Business Insider August 23httpswwwbusinessinsidercomcredit-suisse-led-blockchain-solution-makes-progress-2017-8

Tinn K 2018 Blockchain and the future of optimal financing contracts Working Paper

Tirole J 1988 The theory of industrial organization Cambridge MIT Press

mdashmdashndash 1999 Incomplete contracts Where do we stand Econometrica 67741ndash81

Turing A M 1937 On computable numbers with an application to the Entscheidungsproblem Proceedings ofthe London Mathematical Society 2230ndash65

Weiss M and E Corsi 2017 Bitfury Blockchain for government HBS Case Study January 12818ndash031

Yermack D 2017 Corporate governance and blockchains Review of Finance 217ndash31

Zurrer R 2017 KeepersmdashWorkers that maintain blockchain networks Medium August 5 httpsmediumcomrzurrerkeepers-workers-that-maintain-blockchain-networks-a40182615b66

11Blockchains and smart contracts

111 Decentralized consensus

112 Smart contracts

113 Information distribution

12A model of decentralized consensus and information

121 Trade finance example

122 Model setup

123 Record-keepers information and misreporting

124 Information distribution and quality of consensus

125 Relating to the literature on information economics

13Blockchain applications in the financial industry

131 Trade and trade finance

132 Trusted payments

133 Other applications

14Verification and informational concerns in practice


21Model setup

22Traditional world


222 Bertrand competition and entry

223 Collusive equilibria

23Blockchain world

231 Smart contracts and enhanced entry

232 Enhanced collusion under permissioned blockchain

24Blockchain disruption

241 Consumer surplus under a public blockchain

242 Dynamic equilibria under blockchain disruption


31Measures to reduce collusion on blockchains

311 Blockchain competition versus firm competition

312 Regulatory nodes and design

313 Separation of usage and consensus generation

32Imperfect consensus

33Information asymmetry and private qualities

331 Allocative inefficiency in the traditional world

332 World with blockchain and equilibrium smart contracts

4 Conclusion

Appendix A Consensus Generation Alternative Specifications

A1 Information Set of Record-keepers

A2 Misreporting and Manipulation

A3 Information Distribution and Quality of Consensus

Appendix B Derivations and Proofs

Internet disrupted off-line commerce Others remain skeptical of its genuineinnovativeness and real-world applicability not to mention its association withmoney laundering or drug dealing1 Figure 1 displays Google searches showingthe rising popularity of the blockchain technology in recent years as well asthe growing number of open-source projects related to blockchain and smartcontracts

In this paper we argue that despite a plethora of definitions descriptionsand applications of blockchain and decentralized ledger the technology andits various incarnations share a core functionality in providing a ldquodecentralizedconsensusrdquo Decentralized consensus is a description of the state of the worldmdashfor example whether the goods have been delivered or whether a paymenthas been mademdashuniversally accepted and acted on by all agents in thesystem Economists have long recognized that consensus enables agents withdivergent perspectives and incentives to interact as if it provided the ldquotruthrdquowhich has profound implications on the functioning of society includingethics contracting and legal enforcement among others What is key forblockchain technology is that such a consensus is generated and maintainedin a decentralized manner which blockchain advocates believe can improvethe resilience of the system and reduce the rent extracted by centralizedthird parties2 For example on the Bitcoin blockchain given the transactionhistory agents can check and verify transaction records digitally to preventldquodouble spendingrdquo the digital currency and freeing everyone from the need ofa centralized trustworthy arbitrator or third party3

Public blockchains and many permissioned blockchains interact withdispersed record-keepers to reach decentralized consensus using the latesttechnologies Two economic forces naturally arise programmable decen-tralized consensus if achieved tends to make contracting on contingencieseasier thanks to its temper-proof and automated nature however achievingsuch consensus requires sufficiently distributing information for verificationConsequently blockchain applications typically feature a fundamental tensionbetween decentralized consensus and information distribution The formerenhances contractibility and is welfare improving whereas the latter couldbe detrimental to the society This fundamental tension we highlight has beensince recognized by governments media and industry research For example

1 The Economist (2015) has argued that ldquothe technology behind bitcoin could change how the economy worksrdquoMarc Andreessen the cocreator of Netscape even exclaimed ldquoThis is the thing This is the distributed trustnetwork that the Internet always needed and never hadrdquo (Fung 2014) On the negative side see Narayanan andClark (2017) Jeffries (2018) and Stinchcombe (2017)

2 This is evident when Satoshi Nakamoto founder of Bitcoin remarked ldquoA lot of people automatically dismisse-currency as a lost cause because of all the companies that failed since the 1990s I hope its obvious it wasonly the centrally controlled nature of those systems that doomed them I think this is the first time were tryinga decentralized non-trust-based systemrdquo (Narayanan et al 2016)

3 Double spending is a potential flaw in a digital cash system in which the same digital currency can be spent morethan once when a consensus record of transaction histories is lacking Such a lack can result when digital filesare duplicated or falsified

1 with probability

sumkwkyk

0 otherwise

maxykisin01

ylowastk =

sumkisinKlowastwk

(1minus

sumkisinKlowast

buyer =Es

[ infinsumt=s+1

)]=δλ

total =Es

[ infinsumt=s+1

]=δλ

inff 1λ

M3M1+M3minusM2

buyer =Es

[ infinsumt=s+1

total =Es

[ infinsumt=s+1

]=δλ

max(ps pf )

ψps +(1minusψ)pf

rule says ψ =sumK

k=K2 (Kk

dq (11)

4 Conclusion

z(y)= Z

) (A1)

z(y)=1

yk (A2)

Kbk (A4)

yk = ω+1

ηk +h

) (A5)

⎡⎢⎢⎢⎢⎣ σ 2K

[σ 2b +

σ 2ε

]︸︷︷︸

manipulation

⎤⎥⎥⎥⎥⎦ (A6)

Proof of Lemma 22

M3M1+M3minusM2

gt 1λ

Proof of Lemma 26

)(1minusδT

)1minusδ

Proof AgainM3

fδBlockchain3

(infinf )=

M3M3+λ(M1minusM2)

we have 1λ

M3M1+M3minusM2

gt 1λ

E[q]minusμ gt

Proof of Lemma 32

maxiqiminuspi (A25)

1minuspq =E

]=qminusμminus

[(q prime)(q)

]Nminus1

dq prime (A27)

References



112 Smart contracts




122 Model setup










21Model setup

22Traditional world




23Blockchain world















4 Conclusion






1 with probability

sumkwkyk

0 otherwise

maxykisin01

ylowastk =

sumkisinKlowastwk

(1minus

sumkisinKlowast

buyer =Es

[ infinsumt=s+1

)]=δλ

total =Es

[ infinsumt=s+1

]=δλ

inff 1λ

M3M1+M3minusM2

buyer =Es

[ infinsumt=s+1

total =Es

[ infinsumt=s+1

]=δλ

max(ps pf )

ψps +(1minusψ)pf

rule says ψ =sumK

k=K2 (Kk

dq (11)

4 Conclusion

z(y)= Z

) (A1)

z(y)=1

yk (A2)

Kbk (A4)

yk = ω+1

ηk +h

) (A5)

⎡⎢⎢⎢⎢⎣ σ 2K

[σ 2b +

σ 2ε

]︸︷︷︸

manipulation

⎤⎥⎥⎥⎥⎦ (A6)

Proof of Lemma 22

M3M1+M3minusM2

gt 1λ

Proof of Lemma 26

)(1minusδT

)1minusδ

Proof AgainM3

fδBlockchain3

(infinf )=

M3M3+λ(M1minusM2)

we have 1λ

M3M1+M3minusM2

gt 1λ

E[q]minusμ gt

Proof of Lemma 32

maxiqiminuspi (A25)

1minuspq =E

]=qminusμminus

[(q prime)(q)

]Nminus1

dq prime (A27)

References



112 Smart contracts




122 Model setup










21Model setup

22Traditional world




23Blockchain world















4 Conclusion






1 with probability

sumkwkyk

0 otherwise

maxykisin01

ylowastk =

sumkisinKlowastwk

(1minus

sumkisinKlowast

buyer =Es

[ infinsumt=s+1

)]=δλ

total =Es

[ infinsumt=s+1

]=δλ

inff 1λ

M3M1+M3minusM2

buyer =Es

[ infinsumt=s+1

total =Es

[ infinsumt=s+1

]=δλ

max(ps pf )

ψps +(1minusψ)pf

rule says ψ =sumK

k=K2 (Kk

dq (11)

4 Conclusion

z(y)= Z

) (A1)

z(y)=1

yk (A2)

Kbk (A4)

yk = ω+1

ηk +h

) (A5)

⎡⎢⎢⎢⎢⎣ σ 2K

[σ 2b +

σ 2ε

]︸︷︷︸

manipulation

⎤⎥⎥⎥⎥⎦ (A6)

Proof of Lemma 22

M3M1+M3minusM2

gt 1λ

Proof of Lemma 26

)(1minusδT

)1minusδ

Proof AgainM3

fδBlockchain3

(infinf )=

M3M3+λ(M1minusM2)

we have 1λ

M3M1+M3minusM2

gt 1λ

E[q]minusμ gt

Proof of Lemma 32

maxiqiminuspi (A25)

1minuspq =E

]=qminusμminus

[(q prime)(q)

]Nminus1

dq prime (A27)

References



112 Smart contracts




122 Model setup










21Model setup

22Traditional world




23Blockchain world















4 Conclusion






1 with probability

sumkwkyk

0 otherwise

maxykisin01

ylowastk =

sumkisinKlowastwk

(1minus

sumkisinKlowast

buyer =Es

[ infinsumt=s+1

)]=δλ

total =Es

[ infinsumt=s+1

]=δλ

inff 1λ

M3M1+M3minusM2

buyer =Es

[ infinsumt=s+1

total =Es

[ infinsumt=s+1

]=δλ

max(ps pf )

ψps +(1minusψ)pf

rule says ψ =sumK

k=K2 (Kk

dq (11)

4 Conclusion

z(y)= Z

) (A1)

z(y)=1

yk (A2)

Kbk (A4)

yk = ω+1

ηk +h

) (A5)

⎡⎢⎢⎢⎢⎣ σ 2K

[σ 2b +

σ 2ε

]︸︷︷︸

manipulation

⎤⎥⎥⎥⎥⎦ (A6)

Proof of Lemma 22

M3M1+M3minusM2

gt 1λ

Proof of Lemma 26

)(1minusδT

)1minusδ

Proof AgainM3

fδBlockchain3

(infinf )=

M3M3+λ(M1minusM2)

we have 1λ

M3M1+M3minusM2

gt 1λ

E[q]minusμ gt

Proof of Lemma 32

maxiqiminuspi (A25)

1minuspq =E

]=qminusμminus

[(q prime)(q)

]Nminus1

dq prime (A27)

References



112 Smart contracts




122 Model setup










21Model setup

22Traditional world




23Blockchain world















4 Conclusion






1 with probability

sumkwkyk

0 otherwise

maxykisin01

ylowastk =

sumkisinKlowastwk

(1minus

sumkisinKlowast

buyer =Es

[ infinsumt=s+1

)]=δλ

total =Es

[ infinsumt=s+1

]=δλ

inff 1λ

M3M1+M3minusM2

buyer =Es

[ infinsumt=s+1

total =Es

[ infinsumt=s+1

]=δλ

max(ps pf )

ψps +(1minusψ)pf

rule says ψ =sumK

k=K2 (Kk

dq (11)

4 Conclusion

z(y)= Z

) (A1)

z(y)=1

yk (A2)

Kbk (A4)

yk = ω+1

ηk +h

) (A5)

⎡⎢⎢⎢⎢⎣ σ 2K

[σ 2b +

σ 2ε

]︸︷︷︸

manipulation

⎤⎥⎥⎥⎥⎦ (A6)

Proof of Lemma 22

M3M1+M3minusM2

gt 1λ

Proof of Lemma 26

)(1minusδT

)1minusδ

Proof AgainM3

fδBlockchain3

(infinf )=

M3M3+λ(M1minusM2)

we have 1λ

M3M1+M3minusM2

gt 1λ

E[q]minusμ gt

Proof of Lemma 32

maxiqiminuspi (A25)

1minuspq =E

]=qminusμminus

[(q prime)(q)

]Nminus1

dq prime (A27)

References



112 Smart contracts




122 Model setup










21Model setup

22Traditional world




23Blockchain world















4 Conclusion






1 with probability

sumkwkyk

0 otherwise

maxykisin01

ylowastk =

sumkisinKlowastwk

(1minus

sumkisinKlowast

buyer =Es

[ infinsumt=s+1

)]=δλ

total =Es

[ infinsumt=s+1

]=δλ

inff 1λ

M3M1+M3minusM2

buyer =Es

[ infinsumt=s+1

total =Es

[ infinsumt=s+1

]=δλ

max(ps pf )

ψps +(1minusψ)pf

rule says ψ =sumK

k=K2 (Kk

dq (11)

4 Conclusion

z(y)= Z

) (A1)

z(y)=1

yk (A2)

Kbk (A4)

yk = ω+1

ηk +h

) (A5)

⎡⎢⎢⎢⎢⎣ σ 2K

[σ 2b +

σ 2ε

]︸︷︷︸

manipulation

⎤⎥⎥⎥⎥⎦ (A6)

Proof of Lemma 22

M3M1+M3minusM2

gt 1λ

Proof of Lemma 26

)(1minusδT

)1minusδ

Proof AgainM3

fδBlockchain3

(infinf )=

M3M3+λ(M1minusM2)

we have 1λ

M3M1+M3minusM2

gt 1λ

E[q]minusμ gt

Proof of Lemma 32

maxiqiminuspi (A25)

1minuspq =E

]=qminusμminus

[(q prime)(q)

]Nminus1

dq prime (A27)

References



112 Smart contracts




122 Model setup










21Model setup

22Traditional world




23Blockchain world















4 Conclusion






1 with probability

sumkwkyk

0 otherwise

maxykisin01

ylowastk =

sumkisinKlowastwk

(1minus

sumkisinKlowast

buyer =Es

[ infinsumt=s+1

)]=δλ

total =Es

[ infinsumt=s+1

]=δλ

inff 1λ

M3M1+M3minusM2

buyer =Es

[ infinsumt=s+1

total =Es

[ infinsumt=s+1

]=δλ

max(ps pf )

ψps +(1minusψ)pf

rule says ψ =sumK

k=K2 (Kk

dq (11)

4 Conclusion

z(y)= Z

) (A1)

z(y)=1

yk (A2)

Kbk (A4)

yk = ω+1

ηk +h

) (A5)

⎡⎢⎢⎢⎢⎣ σ 2K

[σ 2b +

σ 2ε

]︸︷︷︸

manipulation

⎤⎥⎥⎥⎥⎦ (A6)

Proof of Lemma 22

M3M1+M3minusM2

gt 1λ

Proof of Lemma 26

)(1minusδT

)1minusδ

Proof AgainM3

fδBlockchain3

(infinf )=

M3M3+λ(M1minusM2)

we have 1λ

M3M1+M3minusM2

gt 1λ

E[q]minusμ gt

Proof of Lemma 32

maxiqiminuspi (A25)

1minuspq =E

]=qminusμminus

[(q prime)(q)

]Nminus1

dq prime (A27)

References



112 Smart contracts




122 Model setup










21Model setup

22Traditional world




23Blockchain world















4 Conclusion






1 with probability

sumkwkyk

0 otherwise

maxykisin01

ylowastk =

sumkisinKlowastwk

(1minus

sumkisinKlowast

buyer =Es

[ infinsumt=s+1

)]=δλ

total =Es

[ infinsumt=s+1

]=δλ

inff 1λ

M3M1+M3minusM2

buyer =Es

[ infinsumt=s+1

total =Es

[ infinsumt=s+1

]=δλ

max(ps pf )

ψps +(1minusψ)pf

rule says ψ =sumK

k=K2 (Kk

dq (11)

4 Conclusion

z(y)= Z

) (A1)

z(y)=1

yk (A2)

Kbk (A4)

yk = ω+1

ηk +h

) (A5)

⎡⎢⎢⎢⎢⎣ σ 2K

[σ 2b +

σ 2ε

]︸︷︷︸

manipulation

⎤⎥⎥⎥⎥⎦ (A6)

Proof of Lemma 22

M3M1+M3minusM2

gt 1λ

Proof of Lemma 26

)(1minusδT

)1minusδ

Proof AgainM3

fδBlockchain3

(infinf )=

M3M3+λ(M1minusM2)

we have 1λ

M3M1+M3minusM2

gt 1λ

E[q]minusμ gt

Proof of Lemma 32

maxiqiminuspi (A25)

1minuspq =E

]=qminusμminus

[(q prime)(q)

]Nminus1

dq prime (A27)

References



112 Smart contracts




122 Model setup










21Model setup

22Traditional world




23Blockchain world















4 Conclusion






1 with probability

sumkwkyk

0 otherwise

maxykisin01

ylowastk =

sumkisinKlowastwk

(1minus

sumkisinKlowast

buyer =Es

[ infinsumt=s+1

)]=δλ

total =Es

[ infinsumt=s+1

]=δλ

inff 1λ

M3M1+M3minusM2

buyer =Es

[ infinsumt=s+1

total =Es

[ infinsumt=s+1

]=δλ

max(ps pf )

ψps +(1minusψ)pf

rule says ψ =sumK

k=K2 (Kk

dq (11)

4 Conclusion

z(y)= Z

) (A1)

z(y)=1

yk (A2)

Kbk (A4)

yk = ω+1

ηk +h

) (A5)

⎡⎢⎢⎢⎢⎣ σ 2K

[σ 2b +

σ 2ε

]︸︷︷︸

manipulation

⎤⎥⎥⎥⎥⎦ (A6)

Proof of Lemma 22

M3M1+M3minusM2

gt 1λ

Proof of Lemma 26

)(1minusδT

)1minusδ

Proof AgainM3

fδBlockchain3

(infinf )=

M3M3+λ(M1minusM2)

we have 1λ

M3M1+M3minusM2

gt 1λ

E[q]minusμ gt

Proof of Lemma 32

maxiqiminuspi (A25)

1minuspq =E

]=qminusμminus

[(q prime)(q)

]Nminus1

dq prime (A27)

References



112 Smart contracts




122 Model setup










21Model setup

22Traditional world




23Blockchain world















4 Conclusion






1 with probability

sumkwkyk

0 otherwise

maxykisin01

ylowastk =

sumkisinKlowastwk

(1minus

sumkisinKlowast

buyer =Es

[ infinsumt=s+1

)]=δλ

total =Es

[ infinsumt=s+1

]=δλ

inff 1λ

M3M1+M3minusM2

buyer =Es

[ infinsumt=s+1

total =Es

[ infinsumt=s+1

]=δλ

max(ps pf )

ψps +(1minusψ)pf

rule says ψ =sumK

k=K2 (Kk

dq (11)

4 Conclusion

z(y)= Z

) (A1)

z(y)=1

yk (A2)

Kbk (A4)

yk = ω+1

ηk +h

) (A5)

⎡⎢⎢⎢⎢⎣ σ 2K

[σ 2b +

σ 2ε

]︸︷︷︸

manipulation

⎤⎥⎥⎥⎥⎦ (A6)

Proof of Lemma 22

M3M1+M3minusM2

gt 1λ

Proof of Lemma 26

)(1minusδT

)1minusδ

Proof AgainM3

fδBlockchain3

(infinf )=

M3M3+λ(M1minusM2)

we have 1λ

M3M1+M3minusM2

gt 1λ

E[q]minusμ gt

Proof of Lemma 32

maxiqiminuspi (A25)

1minuspq =E

]=qminusμminus

[(q prime)(q)

]Nminus1

dq prime (A27)

References



112 Smart contracts




122 Model setup










21Model setup

22Traditional world




23Blockchain world















4 Conclusion






1 with probability

sumkwkyk

0 otherwise

maxykisin01

ylowastk =

sumkisinKlowastwk

(1minus

sumkisinKlowast

buyer =Es

[ infinsumt=s+1

)]=δλ

total =Es

[ infinsumt=s+1

]=δλ

inff 1λ

M3M1+M3minusM2

buyer =Es

[ infinsumt=s+1

total =Es

[ infinsumt=s+1

]=δλ

max(ps pf )

ψps +(1minusψ)pf

rule says ψ =sumK

k=K2 (Kk

dq (11)

4 Conclusion

z(y)= Z

) (A1)

z(y)=1

yk (A2)

Kbk (A4)

yk = ω+1

ηk +h

) (A5)

⎡⎢⎢⎢⎢⎣ σ 2K

[σ 2b +

σ 2ε

]︸︷︷︸

manipulation

⎤⎥⎥⎥⎥⎦ (A6)

Proof of Lemma 22

M3M1+M3minusM2

gt 1λ

Proof of Lemma 26

)(1minusδT

)1minusδ

Proof AgainM3

fδBlockchain3

(infinf )=

M3M3+λ(M1minusM2)

we have 1λ

M3M1+M3minusM2

gt 1λ

E[q]minusμ gt

Proof of Lemma 32

maxiqiminuspi (A25)

1minuspq =E

]=qminusμminus

[(q prime)(q)

]Nminus1

dq prime (A27)

References



112 Smart contracts




122 Model setup










21Model setup

22Traditional world




23Blockchain world















4 Conclusion






1 with probability

sumkwkyk

0 otherwise

maxykisin01

ylowastk =

sumkisinKlowastwk

(1minus

sumkisinKlowast

buyer =Es

[ infinsumt=s+1

)]=δλ

total =Es

[ infinsumt=s+1

]=δλ

inff 1λ

M3M1+M3minusM2

buyer =Es

[ infinsumt=s+1

total =Es

[ infinsumt=s+1

]=δλ

max(ps pf )

ψps +(1minusψ)pf

rule says ψ =sumK

k=K2 (Kk

dq (11)

4 Conclusion

z(y)= Z

) (A1)

z(y)=1

yk (A2)

Kbk (A4)

yk = ω+1

ηk +h

) (A5)

⎡⎢⎢⎢⎢⎣ σ 2K

[σ 2b +

σ 2ε

]︸︷︷︸

manipulation

⎤⎥⎥⎥⎥⎦ (A6)

Proof of Lemma 22

M3M1+M3minusM2

gt 1λ

Proof of Lemma 26

)(1minusδT

)1minusδ

Proof AgainM3

fδBlockchain3

(infinf )=

M3M3+λ(M1minusM2)

we have 1λ

M3M1+M3minusM2

gt 1λ

E[q]minusμ gt

Proof of Lemma 32

maxiqiminuspi (A25)

1minuspq =E

]=qminusμminus

[(q prime)(q)

]Nminus1

dq prime (A27)

References



112 Smart contracts




122 Model setup










21Model setup

22Traditional world




23Blockchain world















4 Conclusion






maxykisin01

ylowastk =

sumkisinKlowastwk

(1minus

sumkisinKlowast

buyer =Es

[ infinsumt=s+1

)]=δλ

total =Es

[ infinsumt=s+1

]=δλ

inff 1λ

M3M1+M3minusM2

buyer =Es

[ infinsumt=s+1

total =Es

[ infinsumt=s+1

]=δλ

max(ps pf )

ψps +(1minusψ)pf

rule says ψ =sumK

k=K2 (Kk

dq (11)

4 Conclusion

z(y)= Z

) (A1)

z(y)=1

yk (A2)

Kbk (A4)

yk = ω+1

ηk +h

) (A5)

⎡⎢⎢⎢⎢⎣ σ 2K

[σ 2b +

σ 2ε

]︸︷︷︸

manipulation

⎤⎥⎥⎥⎥⎦ (A6)

Proof of Lemma 22

M3M1+M3minusM2

gt 1λ

Proof of Lemma 26

)(1minusδT

)1minusδ

Proof AgainM3

fδBlockchain3

(infinf )=

M3M3+λ(M1minusM2)

we have 1λ

M3M1+M3minusM2

gt 1λ

E[q]minusμ gt

Proof of Lemma 32

maxiqiminuspi (A25)

1minuspq =E

]=qminusμminus

[(q prime)(q)

]Nminus1

dq prime (A27)

References



112 Smart contracts




122 Model setup










21Model setup

22Traditional world




23Blockchain world















4 Conclusion






buyer =Es

[ infinsumt=s+1

)]=δλ

total =Es

[ infinsumt=s+1

]=δλ

inff 1λ

M3M1+M3minusM2

buyer =Es

[ infinsumt=s+1

total =Es

[ infinsumt=s+1

]=δλ

max(ps pf )

ψps +(1minusψ)pf

rule says ψ =sumK

k=K2 (Kk

dq (11)

4 Conclusion

z(y)= Z

) (A1)

z(y)=1

yk (A2)

Kbk (A4)

yk = ω+1

ηk +h

) (A5)

⎡⎢⎢⎢⎢⎣ σ 2K

[σ 2b +

σ 2ε

]︸︷︷︸

manipulation

⎤⎥⎥⎥⎥⎦ (A6)

Proof of Lemma 22

M3M1+M3minusM2

gt 1λ

Proof of Lemma 26

)(1minusδT

)1minusδ

Proof AgainM3

fδBlockchain3

(infinf )=

M3M3+λ(M1minusM2)

we have 1λ

M3M1+M3minusM2

gt 1λ

E[q]minusμ gt

Proof of Lemma 32

maxiqiminuspi (A25)

1minuspq =E

]=qminusμminus

[(q prime)(q)

]Nminus1

dq prime (A27)

References



112 Smart contracts




122 Model setup










21Model setup

22Traditional world




23Blockchain world















4 Conclusion






buyer =Es

[ infinsumt=s+1

)]=δλ

total =Es

[ infinsumt=s+1

]=δλ

inff 1λ

M3M1+M3minusM2

buyer =Es

[ infinsumt=s+1

total =Es

[ infinsumt=s+1

]=δλ

max(ps pf )

ψps +(1minusψ)pf

rule says ψ =sumK

k=K2 (Kk

dq (11)

4 Conclusion

z(y)= Z

) (A1)

z(y)=1

yk (A2)

Kbk (A4)

yk = ω+1

ηk +h

) (A5)

⎡⎢⎢⎢⎢⎣ σ 2K

[σ 2b +

σ 2ε

]︸︷︷︸

manipulation

⎤⎥⎥⎥⎥⎦ (A6)

Proof of Lemma 22

M3M1+M3minusM2

gt 1λ

Proof of Lemma 26

)(1minusδT

)1minusδ

Proof AgainM3

fδBlockchain3

(infinf )=

M3M3+λ(M1minusM2)

we have 1λ

M3M1+M3minusM2

gt 1λ

E[q]minusμ gt

Proof of Lemma 32

maxiqiminuspi (A25)

1minuspq =E

]=qminusμminus

[(q prime)(q)

]Nminus1

dq prime (A27)

References



112 Smart contracts




122 Model setup










21Model setup

22Traditional world




23Blockchain world















4 Conclusion






buyer =Es

[ infinsumt=s+1

)]=δλ

total =Es

[ infinsumt=s+1

]=δλ

inff 1λ

M3M1+M3minusM2

buyer =Es

[ infinsumt=s+1

total =Es

[ infinsumt=s+1

]=δλ

max(ps pf )

ψps +(1minusψ)pf

rule says ψ =sumK

k=K2 (Kk

dq (11)

4 Conclusion

z(y)= Z

) (A1)

z(y)=1

yk (A2)

Kbk (A4)

yk = ω+1

ηk +h

) (A5)

⎡⎢⎢⎢⎢⎣ σ 2K

[σ 2b +

σ 2ε

]︸︷︷︸

manipulation

⎤⎥⎥⎥⎥⎦ (A6)

Proof of Lemma 22

M3M1+M3minusM2

gt 1λ

Proof of Lemma 26

)(1minusδT

)1minusδ

Proof AgainM3

fδBlockchain3

(infinf )=

M3M3+λ(M1minusM2)

we have 1λ

M3M1+M3minusM2

gt 1λ

E[q]minusμ gt

Proof of Lemma 32

maxiqiminuspi (A25)

1minuspq =E

]=qminusμminus

[(q prime)(q)

]Nminus1

dq prime (A27)

References



112 Smart contracts




122 Model setup










21Model setup

22Traditional world




23Blockchain world















4 Conclusion






buyer =Es

[ infinsumt=s+1

)]=δλ

total =Es

[ infinsumt=s+1

]=δλ

inff 1λ

M3M1+M3minusM2

buyer =Es

[ infinsumt=s+1

total =Es

[ infinsumt=s+1

]=δλ

max(ps pf )

ψps +(1minusψ)pf

rule says ψ =sumK

k=K2 (Kk

dq (11)

4 Conclusion

z(y)= Z

) (A1)

z(y)=1

yk (A2)

Kbk (A4)

yk = ω+1

ηk +h

) (A5)

⎡⎢⎢⎢⎢⎣ σ 2K

[σ 2b +

σ 2ε

]︸︷︷︸

manipulation

⎤⎥⎥⎥⎥⎦ (A6)

Proof of Lemma 22

M3M1+M3minusM2

gt 1λ

Proof of Lemma 26

)(1minusδT

)1minusδ

Proof AgainM3

fδBlockchain3

(infinf )=

M3M3+λ(M1minusM2)

we have 1λ

M3M1+M3minusM2

gt 1λ

E[q]minusμ gt

Proof of Lemma 32

maxiqiminuspi (A25)

1minuspq =E

]=qminusμminus

[(q prime)(q)

]Nminus1

dq prime (A27)

References



112 Smart contracts




122 Model setup










21Model setup

22Traditional world




23Blockchain world















4 Conclusion






buyer =Es

[ infinsumt=s+1

)]=δλ

total =Es

[ infinsumt=s+1

]=δλ

inff 1λ

M3M1+M3minusM2

buyer =Es

[ infinsumt=s+1

total =Es

[ infinsumt=s+1

]=δλ

max(ps pf )

ψps +(1minusψ)pf

rule says ψ =sumK

k=K2 (Kk

dq (11)

4 Conclusion

z(y)= Z

) (A1)

z(y)=1

yk (A2)

Kbk (A4)

yk = ω+1

ηk +h

) (A5)

⎡⎢⎢⎢⎢⎣ σ 2K

[σ 2b +

σ 2ε

]︸︷︷︸

manipulation

⎤⎥⎥⎥⎥⎦ (A6)

Proof of Lemma 22

M3M1+M3minusM2

gt 1λ

Proof of Lemma 26

)(1minusδT

)1minusδ

Proof AgainM3

fδBlockchain3

(infinf )=

M3M3+λ(M1minusM2)

we have 1λ

M3M1+M3minusM2

gt 1λ

E[q]minusμ gt

Proof of Lemma 32

maxiqiminuspi (A25)

1minuspq =E

]=qminusμminus

[(q prime)(q)

]Nminus1

dq prime (A27)

References



112 Smart contracts




122 Model setup










21Model setup

22Traditional world




23Blockchain world















4 Conclusion






buyer =Es

[ infinsumt=s+1

)]=δλ

total =Es

[ infinsumt=s+1

]=δλ

inff 1λ

M3M1+M3minusM2

buyer =Es

[ infinsumt=s+1

total =Es

[ infinsumt=s+1

]=δλ

max(ps pf )

ψps +(1minusψ)pf

rule says ψ =sumK

k=K2 (Kk

dq (11)

4 Conclusion

z(y)= Z

) (A1)

z(y)=1

yk (A2)

Kbk (A4)

yk = ω+1

ηk +h

) (A5)

⎡⎢⎢⎢⎢⎣ σ 2K

[σ 2b +

σ 2ε

]︸︷︷︸

manipulation

⎤⎥⎥⎥⎥⎦ (A6)

Proof of Lemma 22

M3M1+M3minusM2

gt 1λ

Proof of Lemma 26

)(1minusδT

)1minusδ

Proof AgainM3

fδBlockchain3

(infinf )=

M3M3+λ(M1minusM2)

we have 1λ

M3M1+M3minusM2

gt 1λ

E[q]minusμ gt

Proof of Lemma 32

maxiqiminuspi (A25)

1minuspq =E

]=qminusμminus

[(q prime)(q)

]Nminus1

dq prime (A27)

References



112 Smart contracts




122 Model setup










21Model setup

22Traditional world




23Blockchain world















4 Conclusion






buyer =Es

[ infinsumt=s+1

)]=δλ

total =Es

[ infinsumt=s+1

]=δλ

inff 1λ

M3M1+M3minusM2

buyer =Es

[ infinsumt=s+1

total =Es

[ infinsumt=s+1

]=δλ

max(ps pf )

ψps +(1minusψ)pf

rule says ψ =sumK

k=K2 (Kk

dq (11)

4 Conclusion

z(y)= Z

) (A1)

z(y)=1

yk (A2)

Kbk (A4)

yk = ω+1

ηk +h

) (A5)

⎡⎢⎢⎢⎢⎣ σ 2K

[σ 2b +

σ 2ε

]︸︷︷︸

manipulation

⎤⎥⎥⎥⎥⎦ (A6)

Proof of Lemma 22

M3M1+M3minusM2

gt 1λ

Proof of Lemma 26

)(1minusδT

)1minusδ

Proof AgainM3

fδBlockchain3

(infinf )=

M3M3+λ(M1minusM2)

we have 1λ

M3M1+M3minusM2

gt 1λ

E[q]minusμ gt

Proof of Lemma 32

maxiqiminuspi (A25)

1minuspq =E

]=qminusμminus

[(q prime)(q)

]Nminus1

dq prime (A27)

References



112 Smart contracts




122 Model setup










21Model setup

22Traditional world




23Blockchain world















4 Conclusion






buyer =Es

[ infinsumt=s+1

)]=δλ

total =Es

[ infinsumt=s+1

]=δλ

inff 1λ

M3M1+M3minusM2

buyer =Es

[ infinsumt=s+1

total =Es

[ infinsumt=s+1

]=δλ

max(ps pf )

ψps +(1minusψ)pf

rule says ψ =sumK

k=K2 (Kk

dq (11)

4 Conclusion

z(y)= Z

) (A1)

z(y)=1

yk (A2)

Kbk (A4)

yk = ω+1

ηk +h

) (A5)

⎡⎢⎢⎢⎢⎣ σ 2K

[σ 2b +

σ 2ε

]︸︷︷︸

manipulation

⎤⎥⎥⎥⎥⎦ (A6)

Proof of Lemma 22

M3M1+M3minusM2

gt 1λ

Proof of Lemma 26

)(1minusδT

)1minusδ

Proof AgainM3

fδBlockchain3

(infinf )=

M3M3+λ(M1minusM2)

we have 1λ

M3M1+M3minusM2

gt 1λ

E[q]minusμ gt

Proof of Lemma 32

maxiqiminuspi (A25)

1minuspq =E

]=qminusμminus

[(q prime)(q)

]Nminus1

dq prime (A27)

References



112 Smart contracts




122 Model setup










21Model setup

22Traditional world




23Blockchain world















4 Conclusion






inff 1λ

M3M1+M3minusM2

buyer =Es

[ infinsumt=s+1

total =Es

[ infinsumt=s+1

]=δλ

max(ps pf )

ψps +(1minusψ)pf

rule says ψ =sumK

k=K2 (Kk

dq (11)

4 Conclusion

z(y)= Z

) (A1)

z(y)=1

yk (A2)

Kbk (A4)

yk = ω+1

ηk +h

) (A5)

⎡⎢⎢⎢⎢⎣ σ 2K

[σ 2b +

σ 2ε

]︸︷︷︸

manipulation

⎤⎥⎥⎥⎥⎦ (A6)

Proof of Lemma 22

M3M1+M3minusM2

gt 1λ

Proof of Lemma 26

)(1minusδT

)1minusδ

Proof AgainM3

fδBlockchain3

(infinf )=

M3M3+λ(M1minusM2)

we have 1λ

M3M1+M3minusM2

gt 1λ

E[q]minusμ gt

Proof of Lemma 32

maxiqiminuspi (A25)

1minuspq =E

]=qminusμminus

[(q prime)(q)

]Nminus1

dq prime (A27)

References



112 Smart contracts




122 Model setup










21Model setup

22Traditional world




23Blockchain world















4 Conclusion






inff 1λ

M3M1+M3minusM2

buyer =Es

[ infinsumt=s+1

total =Es

[ infinsumt=s+1

]=δλ

max(ps pf )

ψps +(1minusψ)pf

rule says ψ =sumK

k=K2 (Kk

dq (11)

4 Conclusion

z(y)= Z

) (A1)

z(y)=1

yk (A2)

Kbk (A4)

yk = ω+1

ηk +h

) (A5)

⎡⎢⎢⎢⎢⎣ σ 2K

[σ 2b +

σ 2ε

]︸︷︷︸

manipulation

⎤⎥⎥⎥⎥⎦ (A6)

Proof of Lemma 22

M3M1+M3minusM2

gt 1λ

Proof of Lemma 26

)(1minusδT

)1minusδ

Proof AgainM3

fδBlockchain3

(infinf )=

M3M3+λ(M1minusM2)

we have 1λ

M3M1+M3minusM2

gt 1λ

E[q]minusμ gt

Proof of Lemma 32

maxiqiminuspi (A25)

1minuspq =E

]=qminusμminus

[(q prime)(q)

]Nminus1

dq prime (A27)

References



112 Smart contracts




122 Model setup










21Model setup

22Traditional world




23Blockchain world















4 Conclusion






buyer =Es

[ infinsumt=s+1

total =Es

[ infinsumt=s+1

]=δλ

max(ps pf )

ψps +(1minusψ)pf

rule says ψ =sumK

k=K2 (Kk

dq (11)

4 Conclusion

z(y)= Z

) (A1)

z(y)=1

yk (A2)

Kbk (A4)

yk = ω+1

ηk +h

) (A5)

⎡⎢⎢⎢⎢⎣ σ 2K

[σ 2b +

σ 2ε

]︸︷︷︸

manipulation

⎤⎥⎥⎥⎥⎦ (A6)

Proof of Lemma 22

M3M1+M3minusM2

gt 1λ

Proof of Lemma 26

)(1minusδT

)1minusδ

Proof AgainM3

fδBlockchain3

(infinf )=

M3M3+λ(M1minusM2)

we have 1λ

M3M1+M3minusM2

gt 1λ

E[q]minusμ gt

Proof of Lemma 32

maxiqiminuspi (A25)

1minuspq =E

]=qminusμminus

[(q prime)(q)

]Nminus1

dq prime (A27)

References



112 Smart contracts




122 Model setup










21Model setup

22Traditional world




23Blockchain world















4 Conclusion






max(ps pf )

ψps +(1minusψ)pf

rule says ψ =sumK

k=K2 (Kk

dq (11)

4 Conclusion

z(y)= Z

) (A1)

z(y)=1

yk (A2)

Kbk (A4)

yk = ω+1

ηk +h

) (A5)

⎡⎢⎢⎢⎢⎣ σ 2K

[σ 2b +

σ 2ε

]︸︷︷︸

manipulation

⎤⎥⎥⎥⎥⎦ (A6)

Proof of Lemma 22

M3M1+M3minusM2

gt 1λ

Proof of Lemma 26

)(1minusδT

)1minusδ

Proof AgainM3

fδBlockchain3

(infinf )=

M3M3+λ(M1minusM2)

we have 1λ

M3M1+M3minusM2

gt 1λ

E[q]minusμ gt

Proof of Lemma 32

maxiqiminuspi (A25)

1minuspq =E

]=qminusμminus

[(q prime)(q)

]Nminus1

dq prime (A27)

References



112 Smart contracts




122 Model setup










21Model setup

22Traditional world




23Blockchain world















4 Conclusion






max(ps pf )

ψps +(1minusψ)pf

rule says ψ =sumK

k=K2 (Kk

dq (11)

4 Conclusion

z(y)= Z

) (A1)

z(y)=1

yk (A2)

Kbk (A4)

yk = ω+1

ηk +h

) (A5)

⎡⎢⎢⎢⎢⎣ σ 2K

[σ 2b +

σ 2ε

]︸︷︷︸

manipulation

⎤⎥⎥⎥⎥⎦ (A6)

Proof of Lemma 22

M3M1+M3minusM2

gt 1λ

Proof of Lemma 26

)(1minusδT

)1minusδ

Proof AgainM3

fδBlockchain3

(infinf )=

M3M3+λ(M1minusM2)

we have 1λ

M3M1+M3minusM2

gt 1λ

E[q]minusμ gt

Proof of Lemma 32

maxiqiminuspi (A25)

1minuspq =E

]=qminusμminus

[(q prime)(q)

]Nminus1

dq prime (A27)

References



112 Smart contracts




122 Model setup










21Model setup

22Traditional world




23Blockchain world















4 Conclusion






max(ps pf )

ψps +(1minusψ)pf

rule says ψ =sumK

k=K2 (Kk

dq (11)

4 Conclusion

z(y)= Z

) (A1)

z(y)=1

yk (A2)

Kbk (A4)

yk = ω+1

ηk +h

) (A5)

⎡⎢⎢⎢⎢⎣ σ 2K

[σ 2b +

σ 2ε

]︸︷︷︸

manipulation

⎤⎥⎥⎥⎥⎦ (A6)

Proof of Lemma 22

M3M1+M3minusM2

gt 1λ

Proof of Lemma 26

)(1minusδT

)1minusδ

Proof AgainM3

fδBlockchain3

(infinf )=

M3M3+λ(M1minusM2)

we have 1λ

M3M1+M3minusM2

gt 1λ

E[q]minusμ gt

Proof of Lemma 32

maxiqiminuspi (A25)

1minuspq =E

]=qminusμminus

[(q prime)(q)

]Nminus1

dq prime (A27)

References



112 Smart contracts




122 Model setup










21Model setup

22Traditional world




23Blockchain world















4 Conclusion






max(ps pf )

ψps +(1minusψ)pf

rule says ψ =sumK

k=K2 (Kk

dq (11)

4 Conclusion

z(y)= Z

) (A1)

z(y)=1

yk (A2)

Kbk (A4)

yk = ω+1

ηk +h

) (A5)

⎡⎢⎢⎢⎢⎣ σ 2K

[σ 2b +

σ 2ε

]︸︷︷︸

manipulation

⎤⎥⎥⎥⎥⎦ (A6)

Proof of Lemma 22

M3M1+M3minusM2

gt 1λ

Proof of Lemma 26

)(1minusδT

)1minusδ

Proof AgainM3

fδBlockchain3

(infinf )=

M3M3+λ(M1minusM2)

we have 1λ

M3M1+M3minusM2

gt 1λ

E[q]minusμ gt

Proof of Lemma 32

maxiqiminuspi (A25)

1minuspq =E

]=qminusμminus

[(q prime)(q)

]Nminus1

dq prime (A27)

References



112 Smart contracts




122 Model setup










21Model setup

22Traditional world




23Blockchain world















4 Conclusion






max(ps pf )

ψps +(1minusψ)pf

rule says ψ =sumK

k=K2 (Kk

dq (11)

4 Conclusion

z(y)= Z

) (A1)

z(y)=1

yk (A2)

Kbk (A4)

yk = ω+1

ηk +h

) (A5)

⎡⎢⎢⎢⎢⎣ σ 2K

[σ 2b +

σ 2ε

]︸︷︷︸

manipulation

⎤⎥⎥⎥⎥⎦ (A6)

Proof of Lemma 22

M3M1+M3minusM2

gt 1λ

Proof of Lemma 26

)(1minusδT

)1minusδ

Proof AgainM3

fδBlockchain3

(infinf )=

M3M3+λ(M1minusM2)

we have 1λ

M3M1+M3minusM2

gt 1λ

E[q]minusμ gt

Proof of Lemma 32

maxiqiminuspi (A25)

1minuspq =E

]=qminusμminus

[(q prime)(q)

]Nminus1

dq prime (A27)

References



112 Smart contracts




122 Model setup










21Model setup

22Traditional world




23Blockchain world















4 Conclusion






max(ps pf )

ψps +(1minusψ)pf

rule says ψ =sumK

k=K2 (Kk

dq (11)

4 Conclusion

z(y)= Z

) (A1)

z(y)=1

yk (A2)

Kbk (A4)

yk = ω+1

ηk +h

) (A5)

⎡⎢⎢⎢⎢⎣ σ 2K

[σ 2b +

σ 2ε

]︸︷︷︸

manipulation

⎤⎥⎥⎥⎥⎦ (A6)

Proof of Lemma 22

M3M1+M3minusM2

gt 1λ

Proof of Lemma 26

)(1minusδT

)1minusδ

Proof AgainM3

fδBlockchain3

(infinf )=

M3M3+λ(M1minusM2)

we have 1λ

M3M1+M3minusM2

gt 1λ

E[q]minusμ gt

Proof of Lemma 32

maxiqiminuspi (A25)

1minuspq =E

]=qminusμminus

[(q prime)(q)

]Nminus1

dq prime (A27)

References



112 Smart contracts




122 Model setup










21Model setup

22Traditional world




23Blockchain world















4 Conclusion






dq (11)

4 Conclusion

z(y)= Z

) (A1)

z(y)=1

yk (A2)

Kbk (A4)

yk = ω+1

ηk +h

) (A5)

⎡⎢⎢⎢⎢⎣ σ 2K

[σ 2b +

σ 2ε

]︸︷︷︸

manipulation

⎤⎥⎥⎥⎥⎦ (A6)

Proof of Lemma 22

M3M1+M3minusM2

gt 1λ

Proof of Lemma 26

)(1minusδT

)1minusδ

Proof AgainM3

fδBlockchain3

(infinf )=

M3M3+λ(M1minusM2)

we have 1λ

M3M1+M3minusM2

gt 1λ

E[q]minusμ gt

Proof of Lemma 32

maxiqiminuspi (A25)

1minuspq =E

]=qminusμminus

[(q prime)(q)

]Nminus1

dq prime (A27)

References



112 Smart contracts




122 Model setup










21Model setup

22Traditional world




23Blockchain world















4 Conclusion






dq (11)

4 Conclusion

z(y)= Z

) (A1)

z(y)=1

yk (A2)

Kbk (A4)

yk = ω+1

ηk +h

) (A5)

⎡⎢⎢⎢⎢⎣ σ 2K

[σ 2b +

σ 2ε

]︸︷︷︸

manipulation

⎤⎥⎥⎥⎥⎦ (A6)

Proof of Lemma 22

M3M1+M3minusM2

gt 1λ

Proof of Lemma 26

)(1minusδT

)1minusδ

Proof AgainM3

fδBlockchain3

(infinf )=

M3M3+λ(M1minusM2)

we have 1λ

M3M1+M3minusM2

gt 1λ

E[q]minusμ gt

Proof of Lemma 32

maxiqiminuspi (A25)

1minuspq =E

]=qminusμminus

[(q prime)(q)

]Nminus1

dq prime (A27)

References



112 Smart contracts




122 Model setup










21Model setup

22Traditional world




23Blockchain world















4 Conclusion






4 Conclusion

z(y)= Z

) (A1)

z(y)=1

yk (A2)

Kbk (A4)

yk = ω+1

ηk +h

) (A5)

⎡⎢⎢⎢⎢⎣ σ 2K

[σ 2b +

σ 2ε

]︸︷︷︸

manipulation

⎤⎥⎥⎥⎥⎦ (A6)

Proof of Lemma 22

M3M1+M3minusM2

gt 1λ

Proof of Lemma 26

)(1minusδT

)1minusδ

Proof AgainM3

fδBlockchain3

(infinf )=

M3M3+λ(M1minusM2)

we have 1λ

M3M1+M3minusM2

gt 1λ

E[q]minusμ gt

Proof of Lemma 32

maxiqiminuspi (A25)

1minuspq =E

]=qminusμminus

[(q prime)(q)

]Nminus1

dq prime (A27)

References



112 Smart contracts




122 Model setup










21Model setup

22Traditional world




23Blockchain world















4 Conclusion






z(y)= Z

) (A1)

z(y)=1

yk (A2)

Kbk (A4)

yk = ω+1

ηk +h

) (A5)

⎡⎢⎢⎢⎢⎣ σ 2K

[σ 2b +

σ 2ε

]︸︷︷︸

manipulation

⎤⎥⎥⎥⎥⎦ (A6)

Proof of Lemma 22

M3M1+M3minusM2

gt 1λ

Proof of Lemma 26

)(1minusδT

)1minusδ

Proof AgainM3

fδBlockchain3

(infinf )=

M3M3+λ(M1minusM2)

we have 1λ

M3M1+M3minusM2

gt 1λ

E[q]minusμ gt

Proof of Lemma 32

maxiqiminuspi (A25)

1minuspq =E

]=qminusμminus

[(q prime)(q)

]Nminus1

dq prime (A27)

References



112 Smart contracts




122 Model setup










21Model setup

22Traditional world




23Blockchain world















4 Conclusion






Kbk (A4)

yk = ω+1

ηk +h

) (A5)

⎡⎢⎢⎢⎢⎣ σ 2K

[σ 2b +

σ 2ε

]︸︷︷︸

manipulation

⎤⎥⎥⎥⎥⎦ (A6)

Proof of Lemma 22

M3M1+M3minusM2

gt 1λ

Proof of Lemma 26

)(1minusδT

)1minusδ

Proof AgainM3

fδBlockchain3

(infinf )=

M3M3+λ(M1minusM2)

we have 1λ

M3M1+M3minusM2

gt 1λ

E[q]minusμ gt

Proof of Lemma 32

maxiqiminuspi (A25)

1minuspq =E

]=qminusμminus

[(q prime)(q)

]Nminus1

dq prime (A27)

References



112 Smart contracts




122 Model setup










21Model setup

22Traditional world




23Blockchain world















4 Conclusion






Proof of Lemma 22

M3M1+M3minusM2

gt 1λ

Proof of Lemma 26

)(1minusδT

)1minusδ

Proof AgainM3

fδBlockchain3

(infinf )=

M3M3+λ(M1minusM2)

we have 1λ

M3M1+M3minusM2

gt 1λ

E[q]minusμ gt

Proof of Lemma 32

maxiqiminuspi (A25)

1minuspq =E

]=qminusμminus

[(q prime)(q)

]Nminus1

dq prime (A27)

References



112 Smart contracts




122 Model setup










21Model setup

22Traditional world




23Blockchain world















4 Conclusion






Proof of Lemma 26

)(1minusδT

)1minusδ

Proof AgainM3

fδBlockchain3

(infinf )=

M3M3+λ(M1minusM2)

we have 1λ

M3M1+M3minusM2

gt 1λ

E[q]minusμ gt

Proof of Lemma 32

maxiqiminuspi (A25)

1minuspq =E

]=qminusμminus

[(q prime)(q)

]Nminus1

dq prime (A27)

References



112 Smart contracts




122 Model setup










21Model setup

22Traditional world




23Blockchain world















4 Conclusion






Proof AgainM3

fδBlockchain3

(infinf )=

M3M3+λ(M1minusM2)

we have 1λ

M3M1+M3minusM2

gt 1λ

E[q]minusμ gt

Proof of Lemma 32

maxiqiminuspi (A25)

1minuspq =E

]=qminusμminus

[(q prime)(q)

]Nminus1

dq prime (A27)

References



112 Smart contracts




122 Model setup










21Model setup

22Traditional world




23Blockchain world















4 Conclusion






1minuspq =E

]=qminusμminus

[(q prime)(q)

]Nminus1

dq prime (A27)

References



112 Smart contracts




122 Model setup










21Model setup

22Traditional world




23Blockchain world















4 Conclusion






References



112 Smart contracts




122 Model setup










21Model setup

22Traditional world




23Blockchain world















4 Conclusion






Documents

Blockchain Disruption and Smart Contracts · [08:32 28/3/2019 RFS-OP-REVF190006.tex] Page: 1754 1754–1797 Blockchain Disruption and Smart Contracts Lin William Cong Booth School